HIGH 8.6 NVD
CVE-2026-111606
Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge arbitrary persons by calling the mergeS
Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge arbitrary persons by calling the mergeSpecifiedPersons account RPC. Attackers knowing two person UUIDs can graft attacker-controlled unverified social ids onto a victim person, then use login or password recovery to take over the victim account.
References
- https://github.com/hcengineering/platform/blob/v0.7.432/server/account/src/operations.ts#L
- https://github.com/hcengineering/platform/commit/afe11faec1b56f278c0882355a69b08cff1eebd9
- https://github.com/hcengineering/platform/issues/10914
- https://hackmd.io/@hieuPenguinnn/huly-platform-merge-specified-persons-missing-authorizati
- https://www.vulncheck.com/advisories/huly-platform-through-0.7.432-account-takeover-via-me
This high severity vulnerability with a CVSS score of 8.6 was published on 2026-10-16 via NVD.
vulnfeed aggregates 16467 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.