CVE-2026-108550: Incorrect Authorization in iflytek skillhub

CVE-2026-108550 describes an incorrect authorization vulnerability in iflytek SkillHub prior to version 0.2.22. The flaw exists in the AccountMergeService and AccountMergeController components, where the merge account flow does not properly verify authorization. An authenticated attacker can abuse the merge initiate endpoint by specifying a target username or OAuth identity, receive the verification token without proper validation, and complete the merge process. This results in the attacker gaining control over the victim's API tokens, roles, and namespace ownership, effectively taking over the victim's account.

Successful exploitation allows an authenticated attacker to take over other user accounts by inheriting their API tokens, roles, and namespace ownership. This can lead to unauthorized access and control over victim accounts, potentially compromising sensitive data and operations associated with those accounts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, restrict access to the merge functionality to trusted users and consider additional verification controls if possible.