Threats tagged 'ghsa-wq7r-c6mg-rqv2'

SkillHub versions before 0.2.22 have an incorrect authorization vulnerability in the AccountMergeService and AccountMergeController. Authenticated attackers can abuse the merge flow to take over other user accounts by initiating a merge with a target username or OAuth identity, obtaining the verification token directly, and confirming the merge. This allows attackers to inherit the victim's API tokens, roles, and namespace ownership.