Threat database

Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge arbitrary persons by calling the mergeSpecifiedPersons account RPC. Attackers knowing two person UUIDs can graft attacker-controlled unverified social ids onto a victim person, then use login or password recovery to take over the victim account.

Huly Platform through 0.7.426 contains a server-side request forgery vulnerability in the print service due to missing hostname allowlist validation. Authenticated workspace members can supply arbitrary URLs to the print endpoint, which Puppeteer renders and returns as downloadable PDFs or images, enabling access to internal metadata services and network hosts.

Huly Platform through 0.7.423, fixed in commit 68cbf8a contains an authenticated server-side request forgery vulnerability in the /import endpoint of front pod that allows workspace users to make arbitrary server requests. Attackers can exploit this by supplying malicious URLs to fetch internal services, exfiltrate responses, and replay credentials against backend systems.

CVE-2026-12213 is an improper authorization vulnerability in the hcengineering Huly Platform affecting versions 0.1 through 0.7.0. The issue exists in the getAccountInfo function within the User Information Handler component, allowing remote attackers to manipulate authorization checks. The vulnerability has a medium severity score of 5.3 and an exploit has been publicly disclosed. The vendor has not responded or provided a fix as of the publication date.

CVE-2026-12212 is a medium severity vulnerability in hcengineering Huly Platform versions 0.1 through 0.7.0. It involves improper access controls in the getMailboxSecret function within the RPC Interface component. The vulnerability can be exploited remotely without user interaction or elevated privileges. The vendor has not responded to the disclosure, and no official patch or mitigation guidance is currently available.

CVE-2026-5623 is a server-side request forgery (SSRF) vulnerability in the hcengineering Huly Platform version 0.7.382. It affects an unspecified part of the Import Endpoint component in the file server/front/src/index.ts. The vulnerability can be exploited remotely without user interaction. Although an exploit is publicly available, there is no vendor response or official remediation at this time. The CVSS 4.0 base score is 5.3, indicating a medium severity level.

CVE-2026-5622 is a medium severity vulnerability in hcengineering Huly Platform version 0.7.382 involving the use of a hard-coded cryptographic key in the JWT Token Handler component. The issue arises from manipulation of the SERVER_SECRET argument, leading to use of a fixed cryptographic key. The vulnerability can be exploited remotely but requires high attack complexity, making exploitation difficult. The vendor has not responded to the disclosure, and no patch or remediation guidance is currently available.