This vulnerability affects the getMailboxSecret function in the server/account/src/operations.ts file of the hcengineering Huly Platform up to version 0.7.0. It results from improper access controls, allowing remote attackers to potentially access sensitive mailbox secrets. The vulnerability has been publicly disclosed, but the vendor has not issued any response or patch. The CVSS 4.0 base score is 5.3, indicating medium severity, with network attack vector, low complexity, no privileges required, and no user interaction needed.

An attacker can remotely exploit this vulnerability to bypass access controls and retrieve mailbox secrets from the affected platform. This could lead to unauthorized access to sensitive information managed by the platform. The impact is limited to confidentiality as indicated by the CVSS vector, with no integrity or availability impact reported.

No official fix or patch is currently available from the vendor, and the vendor has not responded to the disclosure. Users should monitor the vendor's communications for any future updates. Until a patch is released, consider restricting network access to the affected service and applying compensating controls to limit exposure to untrusted networks.