CVE-2026-111606

Executive Summary

CVE-2026-111606 is a missing authorization vulnerability in the Huly Platform (through version 0.7.432) that allows any authenticated user to invoke the mergeSpecifiedPersons account RPC to merge arbitrary person records. By grafting attacker-controlled unverified social identifiers (social ids) onto a victim's person object, an attacker can subsequently leverage login or password recovery flows to fully take over the victim's account. With a CVSS base score of 8.1 (High) and no public exploit or patch currently available, every self-hosted or cloud Huly deployment running an affected version is at risk.

Technical Analysis

The vulnerability is classified as CWE-862 (Missing Authorization). Huly exposes an account remote procedure call (RPC) named mergeSpecifiedPersons. Per the NVD description, this RPC lacks a proper authorization check, meaning any authenticated user — regardless of privilege level — can invoke it and merge arbitrary person entities.

The core issue is not a memory-safety flaw or an injection defect; it is a broken access control (BOLA/BFLA-class) flaw. The merge operation is intended to consolidate duplicate person records, but no validation is performed to confirm that the caller owns, controls, or has administrative authority over the person records being merged. An attacker who knows two person UUIDs can:

1. Identify the victim's person UUID and a second person UUID that the attacker controls (or can otherwise reference).
2. Invoke mergeSpecifiedPersons to merge the two persons, effectively grafting the attacker-controlled unverified social ids onto the victim's person object.

The grafted "unverified social ids" are the pivot point. Because login and password-recovery flows in Huly can be driven by social identity associations, an attacker who injects their own social id onto the victim's person record can then initiate authentication or recovery as the victim (or recover access to the victim's account using the attacker-controlled identity).

Because this is a server-side authorization gap in an RPC endpoint, the attack surface is the network-facing account RPC interface. The only precondition is a valid authenticated session (PR:L in the CVSS vector reflects low privileges required — any authenticated user, not necessarily admin). No user interaction (UI:N) is required beyond normal system operation, and the attack is network-reachable (AV:N) with low complexity (AC:L).

Note: No public proof-of-concept exists. The mechanism described above is derived directly from the NVD description; specific request payload schemas, parameter names beyond mergeSpecifiedPersons, internal function names, and endpoint paths are not disclosed in available sources and are therefore not asserted here.

Exploitation Scenarios

The following attack chain is inferred from the vulnerability class (missing authorization on a person-merge RPC) and the NVD description. No public PoC is available; details beyond those stated in the advisory are not fabricated.

1. Reconnaissance / Target Identification. The attacker obtains an authenticated account on the target Huly instance (any low-privileged user). They enumerate or otherwise learn the target person UUIDs — specifically the victim's person UUID and a second person UUID the attacker can leverage. UUIDs may be exposed through normal workspace interactions, directory listings, or API responses accessible to authenticated users. The attacker also identifies the mergeSpecifiedPersons account RPC as reachable from their session.
2. Triggering the Flaw (Missing Authorization). The attacker calls the mergeSpecifiedPersons account RPC with the two person identifiers. The server, lacking an authorization check, processes the merge without verifying that the caller is permitted to merge those two specific persons. This is the authorization bypass: the flaw class is broken function-level/object-level access control (CWE-862).
3. Payload / Execution Method. The merge operation causes the attacker-controlled, unverified social ids to be grafted onto the victim's person record. Because the social ids are unverified, the attacker can now associate an identity they control with the victim's person object. At the vulnerability-class level, the "payload" is the crafted RPC invocation carrying attacker-supplied identity linkage data; the success condition is that the resulting person record contains the attacker's identity data.
4. Post-Exploitation Impact. With the attacker-controlled social id now bound to the victim's person, the attacker invokes the login or password-recovery flow. Using their controlled identity, they authenticate or reset credentials as the victim, resulting in full account takeover. From there, the attacker gains the victim's privileges, access to workspaces, messages, files, and any integrations or tokens tied to the account.

Because the merge is destructive/consolidating by nature, the exploit may also corrupt the victim's original person record — creating a denial-of-service effect on legitimate identity data even before takeover completes.

Impact Assessment

The CVSS 3.1 base score is 8.1 (High): AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N.

• Confidentiality: High (C:H). Account takeover exposes all data the victim can access, including workspace content, messages, documents, and any secrets or tokens associated with the account.
• Integrity: High (I:H). The attacker can modify the victim's person record (merging identities), pivot via recovery flows, and act as the victim across the platform.
• Availability: None (A:N). The vulnerability does not directly degrade availability of the platform, though the destructive nature of merging person records can functionally deny the victim access to their original identity data.
• Privileges Required: Low (PR:L). Any authenticated user qualifies; no admin role is needed.
• User Interaction: None (UI:N). No action by the victim is required.
• Scope: Unchanged (S:U). Impact remains within the same security authority.

Blast radius: Any Huly deployment (self-hosted or hosted) at or below version 0.7.432 with the account RPC interface reachable by authenticated users. Because the flaw requires only a valid session, a single compromised or self-registered account can be used to target other users. High-value targets include administrators, workspace owners, and users with access to sensitive integrations or credentials. Multi-tenant or shared workspaces increase the risk, as many person UUIDs may be enumerable.

Detection Guidance

Sigma Rule

title: Huly mergeSpecifiedPersons Unauthorized Account RPC Invocation
id: 8f3c1b2a-4d5e-4f6a-9b7c-1a2b3c4d5e6f
status: experimental
description: Detects calls to the Huly account RPC mergeSpecifiedPersons, which may indicate exploitation of CVE-2026-111606 (missing authorization).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-111606
author: Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1190
  - attack.initial_access
logsource:
  category: webserver
  product: huly
detection:
  selection_method:
    cs-method: 'POST'
  selection_uri:
    cs-uri-query|contains: 'mergeSpecifiedPersons'
  selection_body:
    cs-body|contains: 'mergeSpecifiedPersons'
  condition: selection_method and (selection_uri or selection_body)
fields:
  - c-ip
  - cs-username
  - cs-uri
  - cs-body
falsepositives:
  - Legitimate administrative person-merge operations
level: high

YARA Rule

rule CVE_2026_111606_Huly_mergeSpecifiedPersons
{
    meta:
        description = "Detects references to the Huly mergeSpecifiedPersons RPC associated with CVE-2026-111606"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-111606"
        severity = "high"

    strings:
        $rpc = "mergeSpecifiedPersons" ascii wide
        $acc = "account" ascii wide nocase

    condition:
        $rpc and $acc
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-111606 Huly mergeSpecifiedPersons Unauthorized Account RPC Invocation"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"mergeSpecifiedPersons"; nocase; reference:cve,2026-111606; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-111606; classtype:attempted-user; sid:2026111606; rev:1;)

Elastic Detection

http where http.request.method == "POST" and
  (http.request.body contains "mergeSpecifiedPersons" or http.request.uri contains "mergeSpecifiedPersons")

Splunk SPL Query

index=web (sourcetype=huly OR sourcetype=access_combined)
| search (uri="*mergeSpecifiedPersons*" OR body="*mergeSpecifiedPersons*")
| stats count min(_time) as first_seen max(_time) as last_seen
        values(src_ip) as source_ips values(user) as users by uri
| sort - count
| where count > 0

Wazuh OSSEC Rule

<group name="huly,web,cve_2026_111606,">
  <rule id="2026116" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <match>mergeSpecifiedPersons</match>
    <description>CVE-2026-111606: Possible unauthorized Huly mergeSpecifiedPersons account RPC invocation</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version metadata is available from tracked sources.

1) Immediate mitigations

• Restrict/disable the mergeSpecifiedPersons account RPC at the reverse proxy or API gateway layer if it is not operationally required; if required, restrict it to trusted admin principals only.
• Enforce network-level access control so that the account RPC interface is not reachable by ordinary authenticated users from untrusted networks (VPN/zero-trust placement).
• Prevent enumeration of person UUIDs where possible; audit which endpoints expose person identifiers to low-privileged users.
• Monitor and alert on all mergeSpecifiedPersons invocations (see Detection Guidance) and investigate unexpected merges.
• Treat account recovery/login flows as sensitive: add step-up verification (e.g., re-authentication, secondary channel confirmation) that does not rely solely on social id linkage.

2) Patch / upgrade steps

• No patch exists as of the available data. Until a vendor fix is released, apply the mitigations above and monitor Huly release notes for a version beyond 0.7.432 that addresses CWE-862 on this RPC.
• When a fix becomes available, upgrade Huly Platform to the first patched release and verify the mergeSpecifiedPersons RPC enforces authorization.

3) Long-term hardening

• Apply function-level and object-level authorization checks to every RPC endpoint (defense against CWE-862); do not rely on authentication alone.
• Adopt least-privilege roles and validate that a caller may act on the specific person records being merged.
• Require verification of social ids before they can be used for login or password recovery.
• Log and correlate identity-linkage changes (merge/recovery) with SIEM detections.

References

• NVD — CVE-2026-111606: https://nvd.nist.gov/vuln/detail/CVE-2026-111606
• CWE-862: Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Huly Platform project/release notes (monitor for versions beyond 0.7.432): https://github.com/hcengineering/platform
• CISA KEV Catalog (no entry for CVE-2026-111606): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public exploit code or proof-of-concept is available, and no exploit-in-the-wild or threat-actor campaign evidence has been identified for CVE-2026-111606 as of this report.