Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-110211— SkillHub through 0.2.22 Missing Authorization in CLI Skill Delete Endpoint

Quick assessment

Affected
iflytek skillhub
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

讯飞开放平台（iFlytek SkillHub）在 0.2.22 及之前版本中存在一处缺少身份验证的漏洞。该漏洞允许任何已认证的用户通过 DELETE /api/cli/v1/skills/{namespace}/{slug} 接口，永久删除其他用户的技能（Skill）。攻击者可通过匿名搜索接口定位目标，并在无需验证所有权的情况下触发删除操作，从而清除所有版本、文件、评论、评分及元数据。

CVSS 8.1 · High EPSS 0.43% · P35

Possible ATT&CK Techniques 1 AI

T1199 · Trusted Relationship

Affected Version Matrix 1

VendorProduct Version RangeStatus
iflytek skillhub ≤ 0.2.22 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-110211

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
SkillHub through 0.2.22 Missing Authorization in CLI Skill Delete Endpoint
Source: CVE Program / CVE List V5
Vulnerability Description
iFlytek SkillHub through 0.2.22 contains a missing authorization vulnerability that allows any authenticated user to permanently delete other users' skills via DELETE /api/cli/v1/skills/{namespace}/{slug}. Attackers can locate targets through the anonymous search endpoint and trigger deletion without ownership checks, purging all versions, files, reviews, ratings and metadata.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
iflytek skillhub 0 ~ 0.2.22 -

II. Public POCs for CVE-2026-110211

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-110211

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-110211 (3)

Vendor Advisories for CVE-2026-110211 (1)

Proof of Concept for CVE-2026-110211 (1)

IV. Related Vulnerabilities

Same product: skillhub
Same vendor: iflytek
Same weakness: CWE-862

V. Comments for CVE-2026-110211

No comments yet

Leave a comment