CVE-2026-110211 — SkillHub through 0.2.22 Missing Authorization in CLI Skill Delete Endpoint
iFlytek SkillHub through 0.2.22 contains a missing authorization vulnerability that allows any authenticated user to permanently delete other users' skills via DELETE /api/cli/v…
Published: 2026-10-13 · CVSS: 7.2 · CVSS 4.0
iFlytek SkillHub through 0.2.22 contains a missing authorization vulnerability that allows any authenticated user to permanently delete other users' skills via DELETE /api/cli/v1/skills/{namespace}/{slug}. Attackers can locate targets through the anonymous search endpoint and trigger deletion without ownership checks, purging all versions, files, reviews, ratings and metadata.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7