CVE-2026-111606 Details
Description
Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge arbitrary persons by calling the mergeSpecifiedPersons account RPC. Attackers knowing two person UUIDs can graft attacker-controlled unverified social ids onto a victim person, then use login or password recovery to take over the victim account.
A missing authorization vulnerability has been identified in Huly Platform versions through 0.7.432. This vulnerability allows any authenticated user to merge arbitrary persons by invoking the 'mergeSpecifiedPersons' account RPC. Attackers who know two person UUIDs can attach unverified social IDs, controlled by the attacker, onto a victim's account. Subsequently, they can use login or password recovery methods to take over the victim's account.
Users should update to Huly Platform version 0.7.437 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 16, 2026CISA-ADP
Assessed Oct 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/hcengineering/platform/blob/v0.7.432/server/account/src/operations.ts#L2921-L2939 | [email protected] | Source CodeVendor |
| https://github.com/hcengineering/platform/commit/afe11faec1b56f278c0882355a69b08cff1eebd9 | [email protected] | Source CodeVendor |
| https://github.com/hcengineering/platform/issues/10914 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://hackmd.io/@hieuPenguinnn/huly-platform-merge-specified-persons-missing-authorization | [email protected] | ExploitTechnical Analysis |
| https://www.vulncheck.com/advisories/huly-platform-through-0.7.432-account-takeover-via-mergespecifiedpersons-rpc | [email protected] | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Huly Platform | <= 0.7.432 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 16, 2026 | CVE Modified | CISA-ADP |
| Oct 16, 2026 | New CVE Received | [email protected] |