CVE-2026-111606 is a high-severity vulnerability in the Huly Platform, version 0.7.432, that allows authenticated users to merge arbitrary persons by calling the mergeSpecifiedPersons account RPC. This could potentially lead to account takeover. Defenders should assess exposure and prioritize remediation, especially in systems where user account security is critical. The impact is supported by official so [truncated]
A vulnerability was found in hcengineering Huly Platform up to 0.7.0. The function getAccountInfo of the file server/account/src/operations.ts, which handles user information, is affected by improper authorization. This vulnerability can be exploited remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond.
CVE-2026-12212 is a vulnerability in Huly Platform up to 0.7.0. The affected component is the RPC Interface, specifically the getMailboxSecret function in server/account/src/operations.ts. The vulnerability leads to improper access controls. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not r [truncated]
A vulnerability was identified in hcengineering Huly Platform 0.7.382, affecting the Import Endpoint in the file server/front/src/index.ts. This leads to server-side request forgery, which can be exploited remotely. The attack has a CVSS score of 2.1 and is considered Low severity. Users of hcengineering Huly Platform 0.7.382 should assess the vulnerability and apply patches or mitigations as available. T [truncated]
A vulnerability was determined in hcengineering Huly Platform 0.7.382. Affected by this issue is some unknown functionality of the file foundations/core/packages/token/src/token.ts of the component JWT Token Handler. This manipulation of the argument SERVER_SECRET with the input secret causes use of hard-coded cryptographic key. The attack can be initiated remotely. The attack is considered to have high c [truncated]
