CVE-2026-111606: Huly Platform through 0.7.432 Account Takeover via mergeSpecifiedPersons RPC
Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge arbitrary persons by calling the mergeSpecifiedPersons account RPC. Attackers knowing two person UUIDs can graft attacker-controlled unverified social ids onto a victim person, then use login or password recovery to take over the victim account.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker must be authenticated and know the UUIDs of both the target person and another person they control. No user interaction is required.
Which deployments are affected?
Huly Platform versions through 0.7.432 are affected. The vulnerable operation is the mergeSpecifiedPersons account RPC, and the provided data does not identify any configuration prerequisite.
What is the practical impact of successful exploitation?
An attacker can attach attacker-controlled, unverified social identities to a victim person record. They can then use login or password recovery to take over the victim account.