---
id: CVE-2026-108550
title: >-
  SkillHub before 0.2.22 contains an incorrect authorization vulnerability in
  AccountMergeService and AccountMergeController that allows authenticated
  attackers to take over other accounts by abusing the merge flow
summary: >-
  SkillHub before 0.2.22 contains an incorrect authorization vulnerability in
  AccountMergeService and AccountMergeController that allows authenticated
  attackers to take over other accounts by abusing the merge flow. Attackers can
  call the …
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-863
published: '2026-10-10'
updated: '2026-10-10'
sourceUpdated: '2026-10-10T15:16:58.133'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-108550'
references:
  - url: 'https://github.com/iflytek/skillhub'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/iflytek/skillhub/blob/v0.2.21/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/merge/AccountMergeService.java#L95-L109
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/iflytek/skillhub/commit/45228996c7dd67f9304dba5b221fef15138a7fc4
    label: disclosure@vulncheck.com
  - url: 'https://github.com/iflytek/skillhub/issues/921'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/iflytek/skillhub/releases/tag/v0.2.22'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/skillhub-before-0.2.22-account-takeover-via-account-merge-flow
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-10-10T15:25:58.087Z'
---

## Overview

SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeController that allows authenticated attackers to take over other accounts by abusing the merge flow. Attackers can call the merge initiate endpoint with a target username or OAuth identity, receive the verification token directly, and confirm the merge to inherit the victim's API tokens, roles and namespace ownership.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.