---
id: "CVE-2026-111606"
kind: "vulnerability"
aliases: ["CVE-2026-111606"]
title: "Huly Platform: any logged-in user can merge other people's accounts"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["account-takeover", "huly", "package", "self-hosted"]
not_affected_if: ["unknown"]
published_at: "2026-10-16T18:17:39+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-25T03:00:08+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111606", "first_seen_at": "2026-10-23T21:57:13+00:00"}]
---

# Huly Platform: any logged-in user can merge other people's accounts

Huly Platform through 0.7.432 lets any authenticated user call the mergeSpecifiedPersons account RPC to merge arbitrary person records. An attacker who knows two person UUIDs can attach their own unverified social IDs to a victim's person and then use login or password recovery to take over the victim's account.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the deployed Huly Platform version against `0.7.432` (unknown how to read it from the sources; check the package or image tag)
- Confirm whether the account service exposes mergeSpecifiedPersons to regular authenticated users

## Fix

- unknown: the sources do not name a fixed version; check the Huly Platform release notes or the NVD entry for a patched release and move past `0.7.432`

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111606

## From the sources

Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge arbitrary persons by calling the mergeSpecifiedPersons account RPC. Attackers knowing two person UUIDs can graft attacker-controlled unverified social ids onto a victim person, then use login or password recovery to take over the victim account.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_