Huly Platform: Missing authorization in mergeSpecifiedPersons RPC enables account takeover
Summary
Huly Platform through version 0.7.432 does not check authorization in the mergeSpecifiedPersons account RPC. Any authenticated user who knows the UUIDs of two persons can merge them, attaching attacker-controlled unverified social IDs to a victim's person record. The attacker can then use login or password recovery to take over the victim's account.
Affected
- Huly Platform through 0.7.432 (hcengineering/platform)
Fixed in
- Unknown. The fix is referenced in commit afe11fa and GitHub issue #10914, but the fixed release version could not be confirmed.
Workaround
- No vendor workaround known.
Exploitation
- Not known to be exploited in the wild; not listed in CISA KEV.
- EPSS 0.00238 (low predicted likelihood).
- A HackMD write-up is referenced; its content was not verified.
Our recommendation
- Check whether your instance runs Huly Platform 0.7.432 or earlier, especially self-hosted instances.
- Update to the latest Huly release once the fixed version is confirmed from the vendor commit.
- Restrict who can create accounts until patched, since the attack requires any valid login.
- Review recent person merges and unexpected social IDs, especially on administrator accounts.
- Enforce strong, unique passwords and enable available second factors.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Huly Platform merge persons source (v0.7.432) github.com
- Fix commit afe11fa github.com
- GitHub issue #10914 github.com
- HackMD write-up hackmd.io
- VulnCheck advisory www.vulncheck.com
- OSV entry CVE-2026-111606 osv.dev
- VulDB entry 421372 vuldb.com
- CNNVD entry CNNVD-2026-86174850 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 07:53.
Original description (NVD)
Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge arbitrary persons by calling the mergeSpecifiedPersons account RPC. Attackers knowing two person UUIDs can graft attacker-controlled unverified social ids onto a victim person, then use login or password recovery to take over the victim account.
NVD references (5)
- https://github.com/hcengineering/platform/blob/v0.7.432/server/account/src/operations.ts#L2921-L2939
- https://github.com/hcengineering/platform/commit/afe11faec1b56f278c0882355a69b08cff1eebd9
- https://github.com/hcengineering/platform/issues/10914
- https://hackmd.io/@hieuPenguinnn/huly-platform-merge-specified-persons-missing-authorization
- https://www.vulncheck.com/advisories/huly-platform-through-0.7.432-account-takeover-via-mergespecifiedpersons…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.