Summary
SkillHub contains an incorrect authorization vulnerability in its account-merge flow that can allow an authenticated attacker to merge another user's account into their own. If the attacker can identify a victim account or OAuth identity and complete the merge process, they may inherit the victim's API tokens, roles, and namespace ownership.
SkillHub contains an incorrect authorization vulnerability in its account-merge flow that can allow an authenticated attacker to merge another user's account into their own. If the attacker can identify a victim account or OAuth identity and complete the merge process, they may inherit the victim's API tokens, roles, and namespace ownership.
Affected context
The vulnerability occurs in SkillHub deployments before 0.2.22, within the AccountMergeService and AccountMergeController components. Risk exists when the merge workflow accepts attacker-controlled target account identifiers, exposes verification material to the requester, and does not independently verify that the requester is authorized to merge the selected accounts.
The vulnerability occurs in SkillHub deployments before 0.2.22, within the AccountMergeService and AccountMergeController components. Risk exists when the merge workflow accepts attacker-controlled target account identifiers, exposes verification material to the requester, and does not independently verify that the requester is authorized to merge the selected accounts.
Exploit preconditions
- Attack surface: Account-merge initiation and confirmation endpoints
- Required access: An authenticated SkillHub account
- Trigger point: A merge request targeting another username or OAuth identity
- Additional condition: The merge workflow must return or otherwise expose verification material without adequately authorizing the target account
- Why exploitation is possible: Authorization checks do not reliably bind the merge operation and its confirmation to the rightful owners of both accounts
- Attack surface: Account-merge initiation and confirmation endpoints
- Required access: An authenticated SkillHub account
- Trigger point: A merge request targeting another username or OAuth identity
- Additional condition: The merge workflow must return or otherwise expose verification material without adequately authorizing the target account
- Why exploitation is possible: Authorization checks do not reliably bind the merge operation and its confirmation to the rightful owners of both accounts
Why this happens
The underlying bug is an authorization failure in a sensitive account-linking operation. The merge flow appears to validate that a requester is authenticated, but does not sufficiently verify that the requester is authorized to control the target account or identity. This maps to CWE-863: Incorrect Authorization, where access-control decisions permit an authenticated subject to perform an operation outside their intended authority.
The underlying bug is an authorization failure in a sensitive account-linking operation. The merge flow appears to validate that a requester is authenticated, but does not sufficiently verify that the requester is authorized to control the target account or identity. This maps to CWE-863: Incorrect Authorization, where access-control decisions permit an authenticated subject to perform an operation outside their intended authority.
Potential impact
- An attacker may take over another user's account
- Victim API tokens could be exposed to or controlled by the attacker
- Account roles and associated privileges could be inherited
- Namespace ownership may be transferred or abused
- Connected resources and data could be modified, deleted, or accessed
- Compromised accounts could facilitate further attacks against other users or services
- An attacker may take over another user's account
- Victim API tokens could be exposed to or controlled by the attacker
- Account roles and associated privileges could be inherited
- Namespace ownership may be transferred or abused
- Connected resources and data could be modified, deleted, or accessed
- Compromised accounts could facilitate further attacks against other users or services
General mitigation guidance
Mitigation generally focuses on enforcing authorization at every stage of the account-merge transaction rather than relying only on authentication.
Common defensive patterns include:
- Require independent proof of control for both accounts or identities involved
- Bind verification challenges to the intended accounts, requester, session, and transaction
- Do not return verification tokens or equivalent secrets to an untrusted requester
- Recheck authorization during confirmation instead of trusting initiation-time state
- Apply explicit ownership and privilege checks before transferring tokens, roles, or namespaces
- Use secure-by-default merge workflows that require deliberate confirmation from both account owners
- Minimize transferred privileges and invalidate or rotate sensitive tokens when account ownership changes
- Log and alert on unusual merge attempts, repeated target changes, and high-privilege ownership transfers
Mitigation generally focuses on enforcing authorization at every stage of the account-merge transaction rather than relying only on authentication.
Common defensive patterns include:
- Require independent proof of control for both accounts or identities involved
- Bind verification challenges to the intended accounts, requester, session, and transaction
- Do not return verification tokens or equivalent secrets to an untrusted requester
- Recheck authorization during confirmation instead of trusting initiation-time state
- Apply explicit ownership and privilege checks before transferring tokens, roles, or namespaces
- Use secure-by-default merge workflows that require deliberate confirmation from both account owners
- Minimize transferred privileges and invalidate or rotate sensitive tokens when account ownership changes
- Log and alert on unusual merge attempts, repeated target changes, and high-privilege ownership transfers
How teams detect issues like this
Detection can combine source review, automated analysis, and runtime monitoring:
- Search for account-merge handlers that authorize only the initiating user
- Review whether target identifiers, OAuth identities, and verification tokens are bound to the same authorized transaction
- Check for confirmation endpoints that trust client-supplied state or initiation results without repeating authorization checks
- Use static analysis and automated code review rules for missing object-level authorization on sensitive operations
- Enforce policies requiring authorization tests for account linking, ownership transfer, token access, and role changes
- Monitor audit logs for merges involving unrelated accounts, unusual OAuth identities, or unexpected namespace transfers
Detection can combine source review, automated analysis, and runtime monitoring:
- Search for account-merge handlers that authorize only the initiating user
- Review whether target identifiers, OAuth identities, and verification tokens are bound to the same authorized transaction
- Check for confirmation endpoints that trust client-supplied state or initiation results without repeating authorization checks
- Use static analysis and automated code review rules for missing object-level authorization on sensitive operations
- Enforce policies requiring authorization tests for account linking, ownership transfer, token access, and role changes
- Monitor audit logs for merges involving unrelated accounts, unusual OAuth identities, or unexpected namespace transfers
