TI-2026-75392 Aliases CVE-2026-111606 GHSA-8cm6-vrv9-4v98

Missing authorization in Huly Platform enables account takeover

LOW 39CWE-862Published 2026-10-16 · Updated 2026-10-16

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · None
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

Huly Platform through 0.7.432 contains a missing authorization flaw (CWE-862) that lets any authenticated user merge arbitrary persons through the mergeSpecifiedPersons account RPC. An attacker who knows two person UUIDs can attach unverified social IDs they control to a victim's person record, then use login or password recovery to take over the victim's account.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge arbitrary persons by calling the mergeSpecifiedPersons account RPC. Attackers knowing two person UUIDs can graft attacker-controlled unverified social ids onto a victim person, then use login or password recovery to take over the victim account.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00238 14th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
hcengineering	Huly Platform	up to 0.7.432	—	No fix listed	CNA

Huly Platform Vendorhcengineering Affected up to 0.7.432 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Huly Platform.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-16 Threatist record created from CVE-2026-111606
2026-10-16 Alias added: GHSA-8cm6-vrv9-4v98
2026-10-18 CISA SSVC decision points changed
2026-10-18 Priority changed: MEDIUM → LOW
2026-11-06 Affected versions changed · Red Hat
2026-11-06 CVSS score added · Red Hat

References

Patch 1

https://github.com/hcengineering/platform/commit/afe11faec1b56f278c0882355a69b08cff1eebd9

Advisory 1

https://hackmd.io/@hieuPenguinnn/huly-platform-merge-specified-persons-missing-authorization

Other 2

TI-2026-40933 Huly Platform - Server-Side Request Forgery via /import Endpoint CVSS 4.0MEDIUM 6.3
TI-2026-04931 hcengineering Huly Platform Import Endpoint index.ts server-side request forgery CVSS 4.0MEDIUM 5.3
TI-2026-61868 Huly Platform through 0.7.426 SSRF via Print Service CVSS 4.0MEDIUM 6.3
TI-2026-04930 hcengineering Huly Platform JWT Token token.ts hard-coded key CVSS 4.0MEDIUM 6.3
TI-2026-10505 hcengineering Huly Platform User Information operations.ts getAccountInfo improper authorization CVSS 4.0MEDIUM 5.3
TI-2026-10504 hcengineering Huly Platform RPC operations.ts getMailboxSecret access control CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences