The Huly Platform up to version 0.7.432 has a missing authorization flaw in the mergeSpecifiedPersons account RPC. Any authenticated user can invoke this operation to merge any two person UUIDs. Attackers can therefore graft attacker‑controlled, unverified social IDs onto a victim's person record and later gain control of the victim account via login or password recovery. This gives full account takeover capabilities.

hcengineering Huly Platform, all releases up to and including 0.7.432, where the mergeSpecifiedPersons RPC is available.

The vulnerability has a CVSS score of 8.6, indicating high severity. Exploitation requires only an authenticated session and is possible for any logged‑in user. Because the attack vector is user‑based and not limited by network constraints, the risk is high for all users of the affected platform. The EPSS score is not available and the issue is not listed in the CISA KEV catalog, but the high CVSS and the ease of exploitation mean that the likelihood of actual attacks remains considerable.