The vulnerability CVE-2026-12213 in hcengineering Huly Platform (versions 0.1 through 0.7.0) involves improper authorization in the getAccountInfo function located in server/account/src/operations.ts within the User Information Handler component. This flaw allows an attacker to remotely manipulate authorization controls, potentially gaining unauthorized access to user account information. The issue has been publicly disclosed, but no official remediation or patch has been provided by the vendor, who did not respond to early contact attempts.

An attacker can remotely exploit this vulnerability to bypass authorization controls in the getAccountInfo function, potentially accessing or manipulating user account information without proper permissions. This could lead to unauthorized disclosure or modification of sensitive user data. The CVSS 4.0 base score of 5.3 reflects a medium severity with network attack vector, low complexity, no privileges required, and no user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch or workaround is available, users should monitor official channels for updates. Until a fix is released, restrict access to the affected component where possible and consider implementing additional access controls or compensating controls to limit exposure.