CVE-2026-108550 in SkillHub
Summary
by MITRE • 10/10/2026
SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeController that allows authenticated attackers to take over other accounts by abusing the merge flow. Attackers can call the merge initiate endpoint with a target username or OAuth identity, receive the verification token directly, and confirm the merge to inherit the victim's API tokens, roles and namespace ownership.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/10/2026
The vulnerability identified in SkillHub versions prior to 0.2.22 represents a critical failure in access control mechanisms within the account merging functionality. Specifically, the flaw resides in the AccountMergeService and AccountMergeController components, which are responsible for handling requests to combine or transfer ownership of user accounts. This issue is classified as an insecure direct object reference combined with broken access controls, aligning closely with CWE-284 Improper Access Control and CWE-639 Injection of Critical Data into a Workflow Step. The core technical flaw lies in the lack of proper authorization checks during the initiation phase of the merge process. Instead of verifying that the requesting user has legitimate ownership or administrative rights over both the source account initiating the request and the target account being merged, the system allows any authenticated user to specify an arbitrary target username or OAuth identity as the destination for a merge operation.
This architectural weakness enables authenticated attackers to exploit the workflow by calling the merge initiation endpoint with credentials belonging to other users. Because the server does not validate that the initiator is authorized to act on behalf of the target account, it proceeds to generate and return a verification token directly to the attacker. This token serves as proof of intent for the merger but is issued without requiring explicit consent or multi-factor confirmation from the victim. The absence of this critical validation step effectively bypasses standard security protocols designed to prevent unauthorized account takeovers. By receiving this token, the attacker gains the necessary credential to proceed with the finalization stage of the merge process, which typically requires user interaction or a secondary verification step that is now trivially completed using the stolen token.
The operational impact of this vulnerability is severe, resulting in complete account takeover for victims whose accounts are targeted. Once the merge is confirmed by the attacker utilizing the obtained verification token, the system transfers all associated assets from the victim's account to the attacker's account. This includes sensitive API tokens that provide access to various services and integrations, user roles and permissions that dictate what actions can be performed within the platform, and namespace ownership which controls intellectual property or project data stored under the victim's identity. Consequently, attackers can impersonate victims, exfiltrate proprietary information, execute malicious operations using elevated privileges, and potentially pivot further into other systems protected by those compromised API tokens. This aligns with MITRE ATT&CK technique T1078 Valid Accounts, as it involves the use of legitimate credentials to gain unauthorized access, and T1534 Internal Spearphishing if used for lateral movement within an organization using SkillHub.
To mitigate this vulnerability, immediate updates to version 0.2.22 or later are required, as these versions contain patches addressing the authorization logic in the merge service. In environments where patching is not immediately feasible, administrators should implement strict input validation and access control checks at the API gateway level. Specifically, any request to initiate an account merge must verify that the authenticated user making the request owns both the source identity and has explicit permission or a verified link with the target identity before generating verification tokens. Additionally, implementing multi-factor authentication for high-risk operations such as merging accounts can add a necessary layer of defense against automated exploitation attempts. Regular security audits focusing on workflow integrity and authorization boundaries are recommended to prevent similar logic flaws in other parts of the application.