---
id: CVE-2026-111606
title: Huly Platform through 0.7.432 Account Takeover via mergeSpecifiedPersons RPC
summary: >-
  Huly Platform through 0.7.432 contains a missing authorization vulnerability
  that allows any authenticated user to merge arbitrary persons by calling the
  mergeSpecifiedPersons account RPC. Attackers knowing two person UUIDs can
  graft att…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-862
vendor: hcengineering
product: Huly Platform
affected:
  - huly_platform <= 0.7.432
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T20:51:49.580691Z'
published: '2026-10-16'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T21:19:52.033Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111606'
references:
  - url: >-
      https://hackmd.io/@hieuPenguinnn/huly-platform-merge-specified-persons-missing-authorization
  - url: 'https://github.com/hcengineering/platform/issues/10914'
  - url: >-
      https://github.com/hcengineering/platform/blob/v0.7.432/server/account/src/operations.ts#L2921-L2939
  - url: >-
      https://github.com/hcengineering/platform/commit/afe11faec1b56f278c0882355a69b08cff1eebd9
  - url: >-
      https://www.vulncheck.com/advisories/huly-platform-through-0.7.432-account-takeover-via-mergespecifiedpersons-rpc
    label: >-
      VulnCheck Advisory: Huly Platform through 0.7.432 Account Takeover via
      mergeSpecifiedPersons RPC
tags:
  - cve.org
ingestedAt: '2026-10-16T18:43:08.698Z'
---

## Overview

Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge arbitrary persons by calling the mergeSpecifiedPersons account RPC. Attackers knowing two person UUIDs can graft attacker-controlled unverified social ids onto a victim person, then use login or password recovery to take over the victim account.

## Affected

- `huly_platform <= 0.7.432`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.