CVE-2026-111606 — Huly Platform through 0.7.432 Account Takeover via mergeSpecifiedPersons RPC
Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge arbitrary persons by calling the mergeSpecifiedPersons a…
Published: 2026-10-16 · CVSS: 8.6 · CVSS 4.0
Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge arbitrary persons by calling the mergeSpecifiedPersons account RPC. Attackers knowing two person UUIDs can graft attacker-controlled unverified social ids onto a victim person, then use login or password recovery to take over the victim account.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7