CVE-2026-111606
HighCVSS 8.1Summary
Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge arbitrary persons by calling the mergeSpecifiedPersons account RPC. Attackers knowing two person UUIDs can graft attacker-controlled unverified social ids onto a victim person, then use login or password recovery to take over the victim account.
Risk Assessment
An attacker can take over a victim's account, leading to unauthorized access to data and actions on behalf of the victim. This poses a serious threat to account security and information confidentiality.
Recommendation
Upgrade Huly Platform to a version later than 0.7.432 if available, or restrict access to the mergeSpecifiedPersons RPC. Implement permission checks and confirmation before merging persons.
Other vulnerabilities in Huly Platform
See all- CVE-2026-91079High
Huly Platform through 0.7.426 contains a server-side request forgery vulnerability in the print service due to missing hostname allowlist validation. Authenticated workspace members can supply arbitrary URLs to the print endpoint, which Puppeteer renders and returns as downloadable PDFs or images, enabling access to internal metadata services and network hosts.
- CVE-2026-56769High
Huly Platform through version 0.7.423 contains an authenticated server-side request forgery (SSRF) vulnerability in the /import endpoint of the front pod. It allows workspace users to make arbitrary server requests by supplying malicious URLs.
- CVE-2026-12213Medium
Vulnerability in hcengineering Huly Platform up to version 0.7.0. The getAccountInfo function in server/account/src/operations.ts (User Information Handler) has improper authorization. The attack can be launched remotely and the exploit is publicly available.
- CVE-2026-12212Medium
In hcengineering Huly Platform up to version 0.7.0, the function getMailboxSecret in file server/account/src/operations.ts (RPC Interface component) has improper access controls. The attack can be initiated remotely, and the exploit is publicly available.
- CVE-2026-5623Medium
Huly Platform (hcengineering) version 0.7.382 has a server-side request forgery vulnerability in the Import endpoint at server/front/src/index.ts. The attack can be launched remotely, and the exploit is publicly available.
Original NVD description (English source)
Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge arbitrary persons by calling the mergeSpecifiedPersons account RPC. Attackers knowing two person UUIDs can graft attacker-controlled unverified social ids onto a victim person, then use login or password recovery to take over the victim account.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS