Huly Platform vulnerabilities
4 known CVE vulnerabilities in Huly Platform, translated and rated.
- CVE-2026-56769High
Huly Platform through version 0.7.423 contains an authenticated server-side request forgery (SSRF) vulnerability in the /import endpoint of the front pod. It allows workspace users to make arbitrary server requests by supplying malicious URLs.
- CVE-2026-12213Medium
Vulnerability in hcengineering Huly Platform up to version 0.7.0. The getAccountInfo function in server/account/src/operations.ts (User Information Handler) has improper authorization. The attack can be launched remotely and the exploit is publicly available.
- CVE-2026-12212Medium
In hcengineering Huly Platform up to version 0.7.0, the function getMailboxSecret in file server/account/src/operations.ts (RPC Interface component) has improper access controls. The attack can be initiated remotely, and the exploit is publicly available.
- CVE-2026-5623Medium
Huly Platform (hcengineering) version 0.7.382 has a server-side request forgery vulnerability in the Import endpoint at server/front/src/index.ts. The attack can be launched remotely, and the exploit is publicly available.