CVE-2026-110211: Missing Authorization in iflytek skillhub

CVE-2026-110211 describes a missing authorization vulnerability in iFlytek SkillHub through version 0.2.22. Authenticated users can exploit this flaw to delete skills owned by other users by sending DELETE requests to the API endpoint /api/cli/v1/skills/{namespace}/{slug} without any ownership checks. The attack results in permanent removal of all skill-related data including versions, files, reviews, ratings, and metadata. Targets can be identified via an anonymous search endpoint, facilitating exploitation.

The vulnerability allows authenticated users to permanently delete other users' skills and all associated data, causing data loss and potential disruption of service for affected users. There is no indication of privilege escalation or remote unauthenticated exploitation. The impact is high due to the permanent deletion of user content and metadata.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user permissions to prevent unauthorized deletion of skills. Monitor for unusual deletion activity and consider implementing additional access controls if possible.