Vulnerability · Published Oct 16, 2026 · Assigned by VulnCheck

CVE-2026-111606Huly Platform through 0.7.432 Account Takeover via mergeSpecifiedPersons RPC

High 8.1

In plain English

A high-severity missing authorization in Huly Platform from hcengineering. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.2%top 85.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge arbitrary persons by calling the mergeSpecifiedPersons account RPC. Attackers knowing two person UUIDs can graft attacker-controlled unverified social ids onto a victim person, then use login or password recovery to take over the victim account.

Affected products (as reported)

Vendor	Product	Versions
hcengineering	Huly Platform	0 – through 0.7.432

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

https://hackmd.io/@hieuPenguinnn/huly-platform-merge-specified-persons-missing-authorization third-party-advisory
https://github.com/hcengineering/platform/issues/10914 issue-tracking
https://github.com/hcengineering/platform/blob/v0.7.432/server/account/src/operations.ts#L2921-L2939 technical-description
https://github.com/hcengineering/platform/commit/afe11faec1b56f278c0882355a69b08cff1eebd9 patch
VulnCheck Advisory: Huly Platform through 0.7.432 Account Takeover via mergeSpecifiedPersons RPC third-party-advisory