CVE-2026-108550 SkillHub before 0.2.22 Account Takeover via Account Merge Flow
Authenticated attackers can take over other accounts by abusing the account merge flow to inherit victim API tokens and roles.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-108550?
CVE-2026-108550 is a high-severity missing authorization vulnerability in iflytek skillhub, published on 10 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeController that allows authenticated attackers to take over other accounts by abusing the merge flow. Attackers can call the merge initiate endpoint with a target username or OAuth identity, receive the verification token directly, and confirm the merge to inherit the victim's API tokens, roles and namespace ownership.
Weakness: CWE-863
Which versions are affected by CVE-2026-108550?
How do I fix CVE-2026-108550?
No fix has been published for CVE-2026-108550 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-108550 being exploited?
There is no known exploitation of CVE-2026-108550 in the wild and no public exploit code.
Sources
Also known as GHSA-wq7r-c6mg-rqv2.