CVE-2026-110211 in SkillHub
Summary
by MITRE • 10/13/2026
iFlytek SkillHub through 0.2.22 contains a missing authorization vulnerability that allows any authenticated user to permanently delete other users' skills via DELETE /api/cli/v1/skills/{namespace}/{slug}. Attackers can locate targets through the anonymous search endpoint and trigger deletion without ownership checks, purging all versions, files, reviews, ratings and metadata.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability identified in iFlytek SkillHub version 0.2.22 represents a critical failure in access control mechanisms, specifically classified under CWE-862 as Missing Authorization. This flaw allows any authenticated user to perform destructive actions on resources they do not own by exploiting the API endpoint DELETE /api/cli/v1/skills/{namespace}/{slug}. The core technical issue lies in the server-side logic which validates that a request originates from an authenticated session but fails to verify whether the authenticated principal is the actual owner of the target skill resource. This oversight creates a direct path for unauthorized data manipulation and destruction, bypassing essential business logic controls designed to protect user-generated content.
Attackers can leverage this vulnerability by first identifying potential targets through the anonymous search endpoint provided by the application. Since the search functionality does not require authentication, it serves as an effective reconnaissance tool for enumerating available skills within the system. Once a target skill is identified based on its namespace and slug parameters, the attacker constructs a malicious HTTP DELETE request to the specified API endpoint while supplying valid but unauthorized credentials. The server processes this request without checking ownership attributes such as user ID or project affiliation, resulting in the immediate and permanent deletion of the targeted resource.
The operational impact of this vulnerability is severe due to the comprehensive nature of the data removal. Upon execution, the attack purges all associated artifacts linked to the skill, including every version history, uploaded files, community reviews, rating metrics, and general metadata. This results in a complete loss of integrity for the affected user's work and potentially disrupts downstream processes that rely on this data. For organizations using iFlytek SkillHub as part of their development or deployment pipelines, such unauthorized deletions can lead to significant operational downtime, loss of intellectual property, and erosion of trust among users who expect secure management of their contributions.
From a threat modeling perspective, this vulnerability aligns with MITRE ATT&CK technique T1485, specifically the Data Destruction sub-technique, where an adversary aims to make data or resources unavailable by destroying them. The ability to locate targets via unauthenticated search further facilitates automated exploitation at scale, allowing malicious actors to disrupt multiple accounts in a short timeframe without needing prior insider knowledge of specific user identifiers beyond public-facing metadata.
To mitigate this risk, immediate remediation should focus on implementing robust object-level access control checks within the DELETE handler for the skills API endpoint. Developers must ensure that every write operation verifies that the authenticated user's identity matches the owner identifier stored in the database record before proceeding with any deletion logic. Additionally, introducing soft-delete mechanisms rather than permanent removal can provide a recovery path for accidental or malicious deletions while maintaining audit trails. It is also advisable to enforce rate limiting on API endpoints and require re-authentication for sensitive operations involving data destruction to add an additional layer of security against automated abuse.