CVE-2026-108550CWE-863broken-access-control

CVE-2026-108550

High · published October 10, 2026

CVSS v3.1
8.8
EPSS
0%
Percentile
21.8
In the wild
Unconfirmed
What it is

SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeController that allows authenticated attackers to take over other accounts by abusing the merge flow. Attackers can call the merge initiate endpoint with a target username or OAuth identity, receive the verification token directly, and confirm the merge to inherit the victim's API tokens, roles and namespace ownership.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00302 · 21.8th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-10-10T19:16Z
References (6)
https://github.com/iflytek/skillhub · [email protected]https://github.com/iflytek/skillhub/blob/v0.2.21/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/merge/AccountMergeService.java#L95-L109 · [email protected]https://github.com/iflytek/skillhub/commit/45228996c7dd67f9304dba5b221fef15138a7fc4 · [email protected]https://github.com/iflytek/skillhub/issues/921 · [email protected]https://github.com/iflytek/skillhub/releases/tag/v0.2.22 · [email protected]https://www.vulncheck.com/advisories/skillhub-before-0.2.22-account-takeover-via-account-merge-flow · [email protected]
EPSS history
Timeline
  • 12 OCT 03:26Z
    EPSS moved — → 0%
    epss
  • 10 OCT 14:35Z
    SkillHub before 0.2.22 Account Takeover via Account Merge Flow
    cvelistv5
  • 10 OCT 14:35Z
    SkillHub before 0.2.22 Account Takeover via Account Merge Flow
    cvelistv5