Skip to content
OpenAdvisories

Vendor

hcengineering

7 known vulnerabilities.

Products

Huly Platform 5 platform 2
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.1
    CVE-2026-111606

    Huly Platform through 0.7.432 Account Takeover via mergeSpecifiedPersons RPC

    Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge arbitrary persons by calling the mergeSpecifiedPersons account RPC. Attackers knowing two person UUIDs can graft attacker-controlled unver…

    hcengineering Huly Platform
  • High 8.5
    CVE-2026-91079

    Huly Platform through 0.7.426 SSRF via Print Service

    Huly Platform through 0.7.426 contains a server-side request forgery vulnerability in the print service due to missing hostname allowlist validation. Authenticated workspace members can supply arbitrary URLs to the print endpoint, which Puppeteer renders and …

    hcengineering platform
  • High 8.5
    CVE-2026-56769

    Huly Platform - Server-Side Request Forgery via /import Endpoint

    Huly Platform through 0.7.423, fixed in commit 68cbf8a contains an authenticated server-side request forgery vulnerability in the /import endpoint of front pod that allows workspace users to make arbitrary server requests. Attackers can exploit this by supply…

    hcengineering platform