Live › vulnerability › CVE-2026-111606
Go to dashboardHuly Platform through 0.7.432 lets any authenticated user call the mergeSpecifiedPersons account RPC to merge arbitrary person records. An attacker who knows two person UUIDs can attach their own unverified social IDs to a victim's person and then use login or password recovery to take over the victim's account.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-hosted or managed Huly Platform deployments at version 0.7.432 or earlier, where any registered user can reach the account RPC. Instances where registration is closed to untrusted users carry less exposure, but the sources do not say how common that setup is.
No product ranges from the sources yet.
0.7.432 (unknown how to read it from the sources; check the package or image tag)0.7.432Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge arbitrary persons by calling the mergeSpecifiedPersons account RPC. Attackers knowing two person UUIDs can graft attacker-controlled unverified social ids onto a victim person, then use login or password recovery to take over the victim account.
This page as .md · .json · in your agent: get_signal("CVE-2026-111606")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.