PT-2026-116005 · Unknown · Huly Platform
CVSS v3.1
8.1
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Huly Platform versions prior to 0.7.433
Description
A missing authorization issue allows authenticated users to merge arbitrary person records by calling the
mergeSpecifiedPersons account RPC. By utilizing two person UUIDs, an attacker can attach unverified social IDs under their control to a victim's profile, subsequently enabling account takeover via login or password recovery mechanisms.Recommendations
Update Huly Platform to version 0.7.433 or later.
Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Huly Platform