This vulnerability in hcengineering Huly Platform up to version 0.7.0 involves improper authorization in the getAccountInfo function of the User Information Handler component (server/account/src/operations.ts). Remote attackers can exploit this flaw to bypass authorization controls. Although an exploit is publicly available, there is no vendor response or official remediation at this time. The CVSS 4.0 base score is 5.3, reflecting medium severity with network attack vector, low complexity, no privileges required, and no user interaction needed.

Successful exploitation allows remote attackers to bypass authorization controls in the getAccountInfo function, potentially exposing or manipulating user account information without proper permissions. This could lead to unauthorized access to sensitive user data within the Huly Platform. No further impact details or privilege escalations are documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should monitor official channels for updates. Until a patch is available, consider restricting network access to the affected service and applying compensating controls to limit exposure of the getAccountInfo functionality.