{"id":"CVE-2026-111606","kind":"vulnerability","aliases":["CVE-2026-111606"],"related":[],"title":"Huly Platform: any logged-in user can merge other people's accounts","description":"Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge arbitrary persons by calling the mergeSpecifiedPersons account RPC. Attackers knowing two person UUIDs can graft attacker-controlled unverified social ids onto a victim person, then use login or password recovery to take over the victim account.","summary":"Huly Platform through 0.7.432 lets any authenticated user call the mergeSpecifiedPersons account RPC to merge arbitrary person records. An attacker who knows two person UUIDs can attach their own unverified social IDs to a victim's person and then use login or password recovery to take over the victim's account.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["account-takeover","huly","package","self-hosted"],"not_affected_if":["unknown"],"how_to_check":"- Check the deployed Huly Platform version against `0.7.432` (unknown how to read it from the sources; check the package or image tag)\n- Confirm whether the account service exposes mergeSpecifiedPersons to regular authenticated users","fix":"- unknown: the sources do not name a fixed version; check the Huly Platform release notes or the NVD entry for a patched release and move past `0.7.432`","status":"open","published_at":"2026-10-16T18:17:39+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T03:00:08+00:00","updated_at":"2026-10-25T03:00:08+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:00:08Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: the sources do not name a fixed version; check the Huly Platform release notes or the NVD entry for a patched release and move past `0.7.432`","reach":"internet","title":"Huly Platform: any logged-in user can merge other people's accounts","impact":"high","summary":"Huly Platform through 0.7.432 lets any authenticated user call the mergeSpecifiedPersons account RPC to merge arbitrary person records. An attacker who knows two person UUIDs can attach their own unverified social IDs to a victim's person and then use login or password recovery to take over the victim's account.","category":"package","nicknames":[],"who_cares":["huly","self-hosted","account-takeover"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker takes over victim accounts by merging person records and recovering them","analyst_note":"Find the upstream Huly advisory or fixed release version and confirm the RPC is reachable by ordinary users; NVD page is the only source given.","how_to_check":"- Check the deployed Huly Platform version against `0.7.432` (unknown how to read it from the sources; check the package or image tag)\n- Confirm whether the account service exposes mergeSpecifiedPersons to regular authenticated users","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Self-hosted or managed Huly Platform deployments at version 0.7.432 or earlier, where any registered user can reach the account RPC. Instances where registration is closed to untrusted users carry less exposure, but the sources do not say how common that setup is.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000623,"input_tokens":3337,"output_tokens":578,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111606':16A,19A '-2026':15A,18A '0.7.432':31B,82C 'account':13A,21B,39B,78B,101C,131C 'account-takeov':20B 'allow':89C 'arbitrari':43B,95C 'attach':54B 'attack':47B,103C,111C 'attacker-control':110C 'authent':34B,91C 'author':86C 'call':36B,98C 'contain':83C 'control':112C 'cve':14A,17A 'graft':109C 'host':27B 'huli':1A,23B,28B,79C 'id':59B,115C 'know':49B,104C 'let':32B 'log':5A 'logged-in':4A 'login':68B,122C 'merg':9A,42B,94C 'mergespecifiedperson':38B,100C 'miss':85C 'onto':116C 'packag':24B 'password':70B,124C 'peopl':11A 'person':44B,51B,64B,96C,106C,119C 'platform':2A,29B,80C 'record':45B 'recoveri':71B,125C 'rpc':40B,102C 'self':26B 'self-host':25B 'social':58B,114C 'take':73B,127C 'takeov':22B 'two':50B,105C 'unverifi':57B,113C 'use':67B,121C 'user':7A,35B,92C 'uuid':52B,107C 'victim':62B,76B,118C,130C 'vulner':87C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted or managed Huly Platform deployments at version 0.7.432 or earlier, where any registered user can reach the account RPC. Instances where registration is closed to untrusted users carry less exposure, but the sources do not say how common that setup is.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:39+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111606","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111606","severity":null,"published_at":"2026-10-16T18:17:39+00:00","modified_at":"2026-10-16T22:17:20+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}