Login Request a demo
High severity · published Oct 16, 2026
CVE-2026-111606
Huly Platform through 0.7.432 Account Takeover via mergeSpecifiedPersons RPC
8.1
CVSS
0.2%
EPSS
No
On KEV
Description
Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge arbitrary persons by calling the mergeSpecifiedPersons account RPC. Attackers knowing two person UUIDs can graft attacker-controlled unverified social ids onto a victim person, then use login or password recovery to take over the victim account.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HP
Huly Platform · hcengineering
through 0.7.432 · source: vendor
Affected product
HP
Huly Platform
hcengineering
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-111606
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-111606
github.com
https://github.com/hcengineering/platform/blob/v0.7.432/server/account/src/operations.ts#L2921-L2939
github.com
https://github.com/hcengineering/platform/commit/afe11faec1b56f278c0882355a69b08cff1eebd9
github.com
https://github.com/hcengineering/platform/issues/10914
hackmd.io
https://hackmd.io/@hieuPenguinnn/huly-platform-merge-specified-persons-missing-authorization
www.vulncheck.com
https://www.vulncheck.com/advisories/huly-platform-through-0.7.432-account-takeover-via-mergespecifiedpersons-rpc
More from Huly Platform
6.3
CVE-2026-5623
hcengineering Huly Platform Import Endpoint index.ts server-side request forgery
4.3
CVE-2026-12213
hcengineering Huly Platform User Information operations.ts getAccountInfo improper authorization
4.3
CVE-2026-12212
hcengineering Huly Platform RPC operations.ts getMailboxSecret access control
3.7
CVE-2026-5622
hcengineering Huly Platform JWT Token token.ts hard-coded key