CVE-2026-111606
Deferred Deferred - Pending Action

Huly Platform Missing Authorization Leading to Account Takeover

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: VulnCheck

Description
Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge arbitrary persons by calling the mergeSpecifiedPersons account RPC. Attackers knowing two person UUIDs can graft attacker-controlled unverified social ids onto a victim person, then use login or password recovery to take over the victim account.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-111606
EUVD
EUVD-2026-103028

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
hcengineering Huly Platform 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-111606 is a missing authorization vulnerability in Huly Platform through version 0.7.432. It allows any authenticated user to merge two arbitrary person accounts by knowing their UUIDs. The system only validates the token but does not check if the caller owns the accounts being merged. This lets attackers graft unverified social identities onto a victim's account and then take over the victim's account via login or password recovery.

Detection Guidance

To detect CVE-2026-111606, monitor for unauthorized merge operations involving person UUIDs. Check server logs for calls to mergeSpecifiedPersons or canMergeSpecifiedPersons endpoints with mismatched ownership. Look for unusual account behavior like unexpected social ID associations or failed login attempts post-merge.

Impact Analysis

If you use Huly Platform versions up to 0.7.432, an attacker could hijack your account by merging it with another account they control. This could lead to unauthorized access to your data, loss of account control, or potential misuse of your identity within the platform.

Compliance Impact

This vulnerability could violate compliance requirements for data protection and access control. It may lead to unauthorized access to personal data, breaching GDPR's principle of data integrity and confidentiality or HIPAA's safeguards for protected health information. Organizations using affected versions risk non-compliance penalties and data breach liabilities.

Mitigation Strategies

Upgrade Huly Platform to a version patched for CVE-2026-111606 (post-v0.7.432). Ensure the fix includes verifyMergePersonsAuthority checks and workspace ownership validation. Temporarily restrict access to mergeSpecifiedPersons endpoints if immediate patching is not possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111606. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart