CVE-2026-111606— Huly Platform through 0.7.432 Account Takeover via mergeSpecifiedPersons RPC
Quick assessment
Affected
hcengineering Huly Platform
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Huly Platform 在版本 0.7.432 及以下存在一个缺少授权验证的漏洞，该漏洞允许任何已认证用户通过调用 账户 RPC 接口，合并任意用户。攻击者若知晓两个用户的 UUID，即可将攻击者控制的未验证社交 ID 嫁接至受害者的用户资料上，随后利用登录或密码找回功能接管受害者的账户。
Possible ATT&CK Techniques 3 AI
T1550 · Use Alternate Authentication Material T1190 · Exploit Public-Facing Application T1078 · Valid AccountsAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| hcengineering | Huly Platform | ≤ 0.7.432 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-111606
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Huly Platform through 0.7.432 Account Takeover via mergeSpecifiedPersons RPC
Source: CVE Program / CVE List V5
Vulnerability Description
Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge arbitrary persons by calling the mergeSpecifiedPersons account RPC. Attackers knowing two person UUIDs can graft attacker-controlled unverified social ids onto a victim person, then use login or password recovery to take over the victim account.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| hcengineering | Huly Platform | 0 ~ 0.7.432 | - |
|
II. Public POCs for CVE-2026-111606
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-111606
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-111606 (1)
Vendor Advisories for CVE-2026-111606 (1)
Proof of Concept for CVE-2026-111606 (1)
IV. Related Vulnerabilities
Same product: Huly Platform
-
CVE-2026-12213
hcengineering Huly Platform User Information operations.ts g -
CVE-2026-12212
hcengineering Huly Platform RPC operations.ts getMailboxSecr -
CVE-2026-5623
hcengineering Huly Platform Import Endpoint index.ts server- -
CVE-2026-5622
hcengineering Huly Platform JWT Token token.ts hard-coded ke
Same vendor: hcengineering
-
CVE-2026-91079
Huly Platform through 0.7.426 SSRF via Print Service -
CVE-2026-56769
Huly Platform - Server-Side Request Forgery via /import Endp -
CVE-2026-12213
hcengineering Huly Platform User Information operations.ts g -
CVE-2026-12212
hcengineering Huly Platform RPC operations.ts getMailboxSecr -
CVE-2026-5623
hcengineering Huly Platform Import Endpoint index.ts server-
Same weakness: CWE-862
-
CVE-2026-112359
WordPress WPMobile.App plugin <= 11.86 - Broken Access Contr -
CVE-2026-112825
WordPress Car Rental Manager plugin <= 1.5.3 - Broken Access -
CVE-2026-112821
WordPress Knit Pay plugin <= 9.6.3.0 - Broken Access Control -
CVE-2026-115373
Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5 -
CVE-2026-115364
OpenBao before 2.6.3 Missing Header Check on Agent/Proxy Qui
V. Comments for CVE-2026-111606
No comments yet