Incorrect Authorization in SkillHub Allows Account Takeover via Merge Flow

Executive Summary

This vulnerability in SkillHub before version 0.2.22 allows authenticated attackers to take over other accounts by exploiting an incorrect authorization flaw in the account merge process. Attackers can initiate a merge with a target username or OAuth identity, receive a verification token directly, and confirm the merge to inherit the victim's API tokens, roles, and namespace ownership without the victim's consent.

Useful 0 Not Useful 0

Detection Guidance

Check SkillHub logs for unusual account merge activities, especially failed or successful merges between unrelated accounts. Look for API calls to /merge endpoints with unexpected username or OAuth identity parameters. Verify if verification tokens are being sent to attacker-controlled channels instead of the target account owner.

Useful 0 Not Useful 0

Impact Analysis

If you use SkillHub before version 0.2.22, an attacker could gain full control of your account by exploiting this flaw. They would inherit your API tokens, roles, and namespace ownership, potentially accessing sensitive data, performing unauthorized actions, or taking over your organization's resources. The attack requires only your username or a known OAuth identity.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. It may result in data breaches, unauthorized disclosures, or loss of control over protected health information, potentially leading to legal penalties and compliance failures.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade SkillHub to version 0.2.22 or later immediately. Disable account merge functionality if not required. Implement strict monitoring for merge operations and revoke all API tokens after merges. Review recent merges for signs of unauthorized activity.

Useful 0 Not Useful 0