CVE-2026-110211: iFlytek SkillHub Auth Bypass Vulnerability

CVE-2026-110211 Overview

CVE-2026-110211 is a missing authorization vulnerability [CWE-862] in iFlytek SkillHub through version 0.2.22. The flaw resides in the CLI skill delete endpoint DELETE /api/cli/v1/skills/{namespace}/{slug}, which fails to verify ownership before deleting a skill. Any authenticated user can permanently destroy skills belonging to other users, purging all versions, files, reviews, ratings, and metadata. Attackers can enumerate deletion targets through the anonymous search endpoint and then issue the delete call with their own valid credentials. The vulnerability affects data integrity and availability without exposing confidentiality.

Critical Impact
Any authenticated SkillHub user can permanently delete arbitrary skills owned by other users, including all associated versions, files, reviews, ratings, and metadata.

Affected Products

iFlytek SkillHub through version 0.2.22
skillhub-app server component (CliSkillController, CliSkillAppService, SkillDeleteAppService)
Deployments exposing the /api/cli/v1/skills/ CLI API to authenticated users

Discovery Timeline

2026-10-13 - CVE-2026-110211 published to the National Vulnerability Database (NVD)
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-110211

Vulnerability Analysis

SkillHub exposes a CLI-oriented REST API for managing user-published skills. The handler in CliSkillController for DELETE /api/cli/v1/skills/{namespace}/{slug} accepts a path identifying a skill and forwards the request to CliSkillAppService, which calls SkillDeleteAppService. None of these layers compares the authenticated principal against the skill's owner before executing the deletion.

The deletion is destructive and cascading. It removes every version of the skill, uploaded files, review records, ratings, and associated metadata. There is no soft-delete, versioned tombstone, or recovery mechanism documented in the referenced code paths. An authenticated attacker therefore achieves permanent data destruction against resources they do not own.

Because the search endpoint is anonymous, reconnaissance requires no credentials. Attackers can list namespace/slug pairs, then supply valid session credentials to invoke the delete. The flaw is a broken access control defect rather than a credential or input-validation issue.

Root Cause

The root cause is a missing authorization check [CWE-862] in the CLI skill delete code path. Authentication confirms that a caller holds a valid session, but no subsequent check verifies that the caller is the owner, maintainer, or administrator of the targeted skill. See the referenced files in CliSkillController, CliSkillAppService, and SkillDeleteAppService.

Attack Vector

Exploitation occurs over the network and requires only a low-privileged authenticated account. The attacker queries the anonymous skill search endpoint to enumerate namespace and slug values, then issues a single DELETE /api/cli/v1/skills/{namespace}/{slug} request using a valid bearer token or session cookie. The server executes the cascading delete without verifying ownership. No user interaction is required. See the VulnCheck Advisory on SkillHub and the HackMD SkillHub CLI Analysis for a detailed walkthrough.

No verified public exploit code is available at the time of publication; the vulnerability mechanism is documented in the vendor source references above.

Detection Methods for CVE-2026-110211

Indicators of Compromise

Unexpected DELETE /api/cli/v1/skills/{namespace}/{slug} requests in reverse proxy or application access logs.
Skill records, versions, files, reviews, or ratings disappearing without a corresponding owner-initiated action in audit history.
Bursts of DELETE requests from a single authenticated session targeting multiple distinct namespace values.

Detection Strategies

Correlate anonymous GET requests against the skill search endpoint with subsequent authenticated DELETE /api/cli/v1/skills/* calls from the same source IP within a short window.
Alert when the account issuing a delete does not match the skill owner recorded in the application database.
Baseline normal per-user delete volumes and flag deviations, particularly deletions crossing namespace boundaries.

Monitoring Recommendations

Enable verbose request logging on the SkillHub ingress with full URI path, user identifier, and response code.
Forward application and web server logs to a centralized analytics platform for retention and correlation.
Monitor database write-ahead logs for cascading deletes against the skills, versions, files, reviews, and ratings tables.

How to Mitigate CVE-2026-110211

Immediate Actions Required

Restrict access to the /api/cli/v1/skills/ routes to trusted networks or administrators until a patched build is deployed.
Disable or gate the anonymous skill search endpoint to slow target enumeration.
Rotate API tokens and session secrets if unauthorized deletions are observed.
Back up the skills database and object storage so that destroyed records can be restored.

Patch Information

At publication, the NVD entry identifies iFlytek SkillHub through 0.2.22 as vulnerable and does not list a fixed version. Monitor the GitHub SkillHub Repository for a release that introduces an ownership check in CliSkillController, CliSkillAppService, and SkillDeleteAppService, and upgrade as soon as a corrected version is published.

Workarounds

Deploy a reverse proxy rule that blocks DELETE requests to /api/cli/v1/skills/* unless the caller is on an allow list.
Patch the application locally to add an ownership comparison between the authenticated principal and the skill owner before invoking SkillDeleteAppService.
Enforce role-based access control at the API gateway so that only administrative tokens may call CLI delete endpoints.

bash

# Example NGINX rule to block external DELETE calls to the vulnerable endpoint
location ~ ^/api/cli/v1/skills/ {
    if ($request_method = DELETE) {
        return 403;
    }
    proxy_pass http://skillhub_upstream;
}