Vulnerability · Published Oct 13, 2026 · Assigned by VulnCheck

CVE-2026-110211SkillHub through 0.2.22 Missing Authorization in CLI Skill Delete Endpoint

High 8.1

In plain English

A high-severity missing authorization in skillhub from iflytek. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.4%top 62.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

iFlytek SkillHub through 0.2.22 contains a missing authorization vulnerability that allows any authenticated user to permanently delete other users' skills via DELETE /api/cli/v1/skills/{namespace}/{slug}. Attackers can locate targets through the anonymous search endpoint and trigger deletion without ownership checks, purging all versions, files, reviews, ratings and metadata.

Affected products (as reported)

Vendor	Product	Versions
iflytek	skillhub	0 – through 0.2.22

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

References

Researcher Advisory third-party-advisory
Vulnerable Code: SkillDeleteAppService (v0.2.22) technical-description
CliSkillController.deleteRemote (v0.2.22) technical-description
CliSkillAppService.deleteRemote (v0.2.22) technical-description
https://github.com/iflytek/skillhub product
VulnCheck Advisory: SkillHub through 0.2.22 Missing Authorization in CLI Skill Delete Endpoint third-party-advisory