https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-17T11:34:05.849060+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-111606 CVE-2026-111606 — Huly Platform through 0.7.432 Account Takeover via mergeSpecifiedPersons RPC 2026-10-17T11:34:05.850958+00:00

Affected: hcengineering Huly Platform

Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge arbitrary persons by calling the mergeSpecifiedPersons account RPC. Attackers knowing two person UUIDs can graft attacker-controlled unverified social ids onto a victim person, then use login or password recovery to take over the victim account.