{"id":"CVE-2026-111606","title":"Huly Platform through 0.7.432 Account Takeover via mergeSpecifiedPersons RPC","summary":"Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge arbitrary persons by calling the mergeSpecifiedPersons account RPC. Attackers knowing two person UUIDs can graft att…","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cvssSource":"cna","cwe":["CWE-862"],"vendor":"hcengineering","product":"Huly Platform","affected":["huly_platform <= 0.7.432"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T20:51:49.580691Z"},"published":"2026-10-16","updated":"2026-10-16","sourceUpdated":"2026-10-16T21:19:52.033Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-111606","references":[{"url":"https://hackmd.io/@hieuPenguinnn/huly-platform-merge-specified-persons-missing-authorization"},{"url":"https://github.com/hcengineering/platform/issues/10914"},{"url":"https://github.com/hcengineering/platform/blob/v0.7.432/server/account/src/operations.ts#L2921-L2939"},{"url":"https://github.com/hcengineering/platform/commit/afe11faec1b56f278c0882355a69b08cff1eebd9"},{"url":"https://www.vulncheck.com/advisories/huly-platform-through-0.7.432-account-takeover-via-mergespecifiedpersons-rpc","label":"VulnCheck Advisory: Huly Platform through 0.7.432 Account Takeover via mergeSpecifiedPersons RPC"}],"tags":["cve.org"],"ingestedAt":"2026-10-16T18:43:08.698Z","slug":"CVE-2026-111606","body":"## Overview\n\nHuly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge arbitrary persons by calling the mergeSpecifiedPersons account RPC. Attackers knowing two person UUIDs can graft attacker-controlled unverified social ids onto a victim person, then use login or password recovery to take over the victim account.\n\n## Affected\n\n- `huly_platform <= 0.7.432`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}