CVE-2026-111606
Huly Platform through 0.7.432 Account Takeover via mergeSpecifiedPersons RPC
hcengineering Huly Platform
CVSS
8.6HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.24%Chance of exploitation activity in the next 30 days, higher than 14% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge arbitrary persons by calling the mergeSpecifiedPersons account RPC. Attackers knowing two person UUIDs can graft attacker-controlled unverified social ids onto a victim person, then use login or password recovery to take over the victim account.
Text from CVE List
Affected versions 1
- Huly Platformaffected: all versions through 0.7.432CVE List
References 5
- github.com/hcengineering/platform/commit/afe11faec1b56f278c0882355a69b08cff1eebd9Fixvia CVE List
- hackmd.io/@hieuPenguinnn/huly-platform-merge-specified-persons-missing-authorizationAdvisoryvia CVE List
- vulncheck.com/advisories/huly-platform-through-0.7.432-account-takeover-via-mergespecifiedpersons-rpcAdvisoryvia CVE List
- github.com/hcengineering/platform/issues/10914Referencevia CVE List
- github.com/hcengineering/platform/blob/v0.7.432/server/account/src/operations.ts#L2921-L2939Referencevia CVE List