CVE-2026-110211: SkillHub through 0.2.22 Missing Authorization in CLI Skill Delete Endpoint
iFlytek SkillHub through 0.2.22 contains a missing authorization vulnerability that allows any authenticated user to permanently delete other users' skills via DELETE /api/cli/v1/skills/{namespace}/{slug}. Attackers can locate targets through the anonymous search endpoint and trigger deletion without ownership checks, purging all versions, files, reviews, ratings and metadata.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated SkillHub user can exploit it. The attacker does not need to own the targeted skill.
How can an attacker identify skills to target?
Targets can be discovered through the anonymous search endpoint. This allows an authenticated attacker to locate skills belonging to other users before sending the delete request.
What is deleted if exploitation succeeds?
Deletion is permanent and removes the targeted skill along with all versions, files, reviews, ratings, and metadata.
Which deployments are known to be affected?
iFlytek SkillHub through version 0.2.22 is affected. The provided information does not identify a configuration prerequisite beyond an attacker having an authenticated account.