This vulnerability in hcengineering Huly Platform versions 0.1 through 0.7.0 involves improper access controls in the getMailboxSecret function located in server/account/src/operations.ts within the RPC Interface component. The flaw allows remote attackers to bypass intended access restrictions, potentially exposing sensitive mailbox secrets. The vulnerability has been publicly disclosed, and the vendor has not issued any patch or official remediation guidance. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low complexity, no privileges required, and no user interaction needed.

The vulnerability allows remote attackers to bypass access controls and potentially retrieve sensitive mailbox secrets from the affected component. This could lead to unauthorized access to confidential information managed by the Huly Platform. However, there is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should monitor official channels for updates. Until a patch is available, consider restricting network access to the affected service or implementing compensating controls to limit exposure of the vulnerable function.