CVE-2026-110211SkillHub through 0.2.22 Missing Authorization in CLI Skill Delete Endpoint

Description

iFlytek SkillHub through 0.2.22 contains a missing authorization vulnerability that allows any authenticated user to permanently delete other users' skills via DELETE /api/cli/v1/skills/{namespace}/{slug}. Attackers can locate targets through the anonymous search endpoint and trigger deletion without ownership checks, purging all versions, files, reviews, ratings and metadata.

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

References and patches

• Researcher Advisory third-party-advisory
• Vulnerable Code: SkillDeleteAppService (v0.2.22) technical-description
• CliSkillController.deleteRemote (v0.2.22) technical-description
• CliSkillAppService.deleteRemote (v0.2.22) technical-description
• https://github.com/iflytek/skillhub product
• VulnCheck Advisory: SkillHub through 0.2.22 Missing Authorization in CLI Skill Delete Endpoint third-party-advisory