CVE-2026-56769

Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge arbitrary persons by calling the mergeSpecifiedPersons account RPC. Attackers knowing two person UUIDs can graft attacker-controlled unverified social ids onto a victim person, then use login or password recovery to take over the victim account.

Huly Platform through 0.7.426 contains a server-side request forgery vulnerability in the print service due to missing hostname allowlist validation. Authenticated workspace members can supply arbitrary URLs to the print endpoint, which Puppeteer renders and returns as downloadable PDFs or images, enabling access to internal metadata services and network hosts.

Vulnerability in hcengineering Huly Platform up to version 0.7.0. The getAccountInfo function in server/account/src/operations.ts (User Information Handler) has improper authorization. The attack can be launched remotely and the exploit is publicly available.

In hcengineering Huly Platform up to version 0.7.0, the function getMailboxSecret in file server/account/src/operations.ts (RPC Interface component) has improper access controls. The attack can be initiated remotely, and the exploit is publicly available.

Huly Platform (hcengineering) version 0.7.382 has a server-side request forgery vulnerability in the Import endpoint at server/front/src/index.ts. The attack can be launched remotely, and the exploit is publicly available.