Missing Authorization Vulnerability in Huly Platform

Huly Platform versions through 0.7.432 contain a critical missing authorization vulnerability (CVE-2026-111606) within the 'mergeSpecifiedPersons' account RPC. This flaw allows any authenticated user to merge arbitrary user accounts by providing the corresponding person UUIDs. By leveraging this RPC, an attacker can graft their own unverified social identities onto a victim's account profile. Once the accounts are merged, the attacker can force password recovery or authentication flows to gain full control over the target's account. This vulnerability poses a significant risk to organizational identity integrity within the Huly environment, as it facilitates unauthorized access to arbitrary user accounts without requiring administrative privileges, provided the attacker can identify the target's UUID.

Impact

The vulnerability results in full account takeover capabilities for any authenticated user within the Huly Platform. This can lead to unauthorized access to sensitive project data, internal communications, and other platform resources associated with the compromised user account. All instances of Huly Platform running versions 0.7.432 and earlier are affected.

Recommendation

Prioritized, concrete actions for detection engineering teams:

• Update Huly Platform to a patched version beyond 0.7.432 immediately.
• Review access logs for excessive or unusual calls to the 'mergeSpecifiedPersons' RPC endpoint.
• Monitor for anomalous account identity associations or suspicious social login activity linked to previously established user accounts.
• Implement restrictive access controls on account management RPCs to prevent unauthorized users from performing identity merge operations.