CVE-2026-111606

8.1High

Published 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

8.1High

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: High impact on confidentiality, integrity
Weakness: CWE-862

Impact

Authenticated attackers can completely take over arbitrary user accounts if they know the victim's person UUID. They need an active account and network access to call the mergeSpecifiedPersons RPC to attach their own identity to the victim.

Root cause

The mergeSpecifiedPersons account RPC lacks authorization checks, allowing any logged-in user to merge arbitrary person profiles.

Affected systems

Huly Platform through 0.7.432

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Fix & remediation

Upgrade Huly Platform to a version containing commit afe11faec1b56f278c0882355a69b08cff1eebd9 (post-0.7.432). If you cannot patch immediately, block or restrict access to the mergeSpecifiedPersons account RPC endpoint at the reverse proxy or API gateway.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge arbitrary persons by calling the mergeSpecifiedPersons account RPC. Attackers knowing two person UUIDs can graft attacker-controlled unverified social ids onto a victim person, then use login or password recovery to take over the victim account.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-111606