Unauthorized Skill Deletion in iFlytek SkillHub

iFlytek SkillHub versions through 0.2.22 are affected by a missing authorization vulnerability (CVE-2026-110211). The vulnerability exists within the DELETE endpoint at /api/cli/v1/skills/{namespace}/{slug}. Due to the absence of proper ownership checks, any authenticated user can successfully execute a DELETE request against skills they do not own. Upon exploitation, the application permanently purges all associated data, including multiple versions of the skill, uploaded files, user reviews, ratings, and internal metadata. This flaw is particularly dangerous in multi-tenant or collaborative environments where users might target rival developers or perform malicious mass-deletion campaigns to disrupt service availability and integrity. Because the target identifiers (namespace and slug) can be discovered via an anonymous search endpoint provided by the platform, the bar for exploitation is extremely low.

Impact

Successful exploitation results in the complete and irreversible loss of data associated with a skill. This impacts users by erasing their contributions, damaging project visibility, and destroying historical metadata such as reviews and ratings. In professional settings, this could lead to significant loss of intellectual property and reputational damage. The vulnerability affects all deployments of iFlytek SkillHub up to and including version 0.2.22.

Recommendation

Prioritized actions to mitigate the risk of CVE-2026-110211:

• Immediately restrict access to the /api/cli/v1/skills/ endpoint if not required for standard operations, or verify if an update from iFlytek is available.
• Audit web server access logs for anomalous patterns of DELETE requests directed at the /api/cli/v1/skills/ endpoint to identify potential abuse.
• If logs indicate unauthorized deletion, enforce strict API authentication and authorization controls that map the requesting user's identity to the resource owner before permitting state-changing operations.