hcengineering/platform vulnerabilities

Latest hcengineering/platform CVEs

Newest publication first

1. CVE-2026-111606 Huly Platform through 0.7.432 Account Takeover via mergeSpecifiedPersons RPC

   Published 2026-10-16

   High·CVSS 8.6 EPSS 0.24%

   Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge arbitrary persons by calling the mergeSpecifiedPersons account RPC. Attackers knowing two person UUIDs can graft attacker-controlled unverified social ids onto...

2. CVE-2026-91079 Huly Platform through 0.7.426 SSRF via Print Service

   Published 2026-09-14

   Medium·CVSS 6.3 EPSS 0.37%

   Huly Platform through 0.7.426 contains a server-side request forgery vulnerability in the print service due to missing hostname allowlist validation. Authenticated workspace members can supply arbitrary URLs to the print endpoint, which Puppeteer renders and returns as downloadab...

3. CVE-2026-56769 Huly Platform - Server-Side Request Forgery via /import Endpoint

   Published 2026-06-25

   Medium·CVSS 6.3 EPSS 0.37%

   Huly Platform through 0.7.423, fixed in commit 68cbf8a contains an authenticated server-side request forgery vulnerability in the /import endpoint of front pod that allows workspace users to make arbitrary server requests. Attackers can exploit this by supplying malicious URLs to...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.