{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-111606/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:huly:huly_platform:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-111606"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Huly Platform (\u003c= 0.7.432)"],"_cs_severities":["high"],"_cs_tags":["identity-management","authentication-bypass","cve-2026-111606"],"_cs_type":"advisory","_cs_vendors":["Huly"],"content_html":"\u003cp\u003eHuly Platform versions through 0.7.432 contain a critical missing authorization vulnerability (CVE-2026-111606) within the 'mergeSpecifiedPersons' account RPC. This flaw allows any authenticated user to merge arbitrary user accounts by providing the corresponding person UUIDs. By leveraging this RPC, an attacker can graft their own unverified social identities onto a victim's account profile. Once the accounts are merged, the attacker can force password recovery or authentication flows to gain full control over the target's account. This vulnerability poses a significant risk to organizational identity integrity within the Huly environment, as it facilitates unauthorized access to arbitrary user accounts without requiring administrative privileges, provided the attacker can identify the target's UUID.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability results in full account takeover capabilities for any authenticated user within the Huly Platform. This can lead to unauthorized access to sensitive project data, internal communications, and other platform resources associated with the compromised user account. All instances of Huly Platform running versions 0.7.432 and earlier are affected.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized, concrete actions for detection engineering teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate Huly Platform to a patched version beyond 0.7.432 immediately.\u003c/li\u003e\n\u003cli\u003eReview access logs for excessive or unusual calls to the 'mergeSpecifiedPersons' RPC endpoint.\u003c/li\u003e\n\u003cli\u003eMonitor for anomalous account identity associations or suspicious social login activity linked to previously established user accounts.\u003c/li\u003e\n\u003cli\u003eImplement restrictive access controls on account management RPCs to prevent unauthorized users from performing identity merge operations.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-16T18:46:26Z","date_published":"2026-10-16T18:46:26Z","id":"https://feed.craftedsignal.io/briefs/2026-10-huly-auth-bypass/","summary":"Huly Platform versions through 0.7.432 contain a missing authorization vulnerability in the mergeSpecifiedPersons RPC, enabling authenticated account takeover.","title":"Missing Authorization Vulnerability in Huly Platform","url":"https://feed.craftedsignal.io/briefs/2026-10-huly-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-111606","version":"https://jsonfeed.org/version/1.1"}