CVE-2026-110211 in SkillHub
Resumen
por MITRE • 2026-10-13
iFlytek SkillHub through 0.2.22 contains a missing authorization vulnerability that allows any authenticated user to permanently delete other users' skills via DELETE /api/cli/v1/skills/{namespace}/{slug}. Attackers can locate targets through the anonymous search endpoint and trigger deletion without ownership checks, purging all versions, files, reviews, ratings and metadata.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.