CVE-2026-108550

Summary

SkillHub's account merge functionality has incorrect authorization that allows authenticated users to hijack other users' accounts by initiating merges with target usernames or OAuth identities. This leads to complete account takeover where attackers inherit all victim data including API tokens, roles, and namespace ownership.

Exploitability

Moderately easy to exploit as it requires only authentication and access to the merge initiate endpoint, with no additional prerequisites beyond having valid credentials for the target account.

Blast radius

High impact in real-world scenarios as attackers can gain full administrative control over victim accounts, potentially leading to data exfiltration, privilege escalation, and unauthorized access to sensitive resources like API tokens and namespaces.

Detection

Monitor for unusual merge initiate requests in application logs that target usernames or OAuth identities not belonging to the requesting user, particularly those with high privilege levels or API token usage patterns.

Prioritized remediation

Apply the patch for SkillHub version 0.2.22 or later to fix the authorization flaw in AccountMergeService and AccountMergeController.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.