Medium severity · published Jun 15, 2026
CVE-2026-12212
hcengineering Huly Platform RPC operations.ts getMailboxSecret access control
4.3
CVSS
0.2%
EPSS
No
On KEV
Description
A vulnerability has been found in hcengineering Huly Platform up to 0.7.0. Affected is the function getMailboxSecret of the file server/account/src/operations.ts of the component RPC Interface. The manipulation leads to improper access controls. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 11% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HP
Huly Platform · hcengineering
0.1; 0.2; 0.3; 0.4; 0.5; 0.6; +1 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-12212
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-12212
vuldb.com
https://vuldb.com/cve/CVE-2026-12212
vuldb.com
https://vuldb.com/submit/832973
vuldb.com
https://vuldb.com/vuln/370854
vuldb.com
https://vuldb.com/vuln/370854/cti
More from Huly Platform
8.1
CVE-2026-111606
Huly Platform through 0.7.432 Account Takeover via mergeSpecifiedPersons RPC
6.3
CVE-2026-5623
hcengineering Huly Platform Import Endpoint index.ts server-side request forgery
4.3
CVE-2026-12213
hcengineering Huly Platform User Information operations.ts getAccountInfo improper authorization
3.7
CVE-2026-5622
hcengineering Huly Platform JWT Token token.ts hard-coded key