CVE-2026-12213: Huly Platform Improper Authorization in User Information Handler

Technical summary

CVE-2026-12213 is an improper authorization vulnerability in the getAccountInfo function within server/account/src/operations.ts of Huly Platform versions up to 0.7.0. The affected component handles user information retrieval but fails to properly validate that the requesting user has authorization to access the target account's data. The vulnerability is categorized under CWE-266 (Incorrect Privilege Assignment) and CWE-285 (Improper Authorization), indicating a breakdown in access control logic. Attack requires network connectivity and valid authentication credentials, but no elevated privileges or user interaction.

Business impact

This vulnerability enables horizontal privilege escalation within Huly Platform deployments. Authenticated users can extract sensitive account metadata about colleagues or other platform users, potentially exposing email addresses, profile details, or linked identity information depending on what getAccountInfo returns. For organizations using Huly for team collaboration or project management, this creates data leakage risk and may violate internal data governance policies. The impact is bounded to confidentiality; integrity and availability are not affected. However, aggregated account enumeration could support social engineering or targeted phishing campaigns.

Affected systems

hcengineering Huly Platform versions 0.7.0 and earlier are affected. The vendor information in source data does not list specific patch versions confirming remediation; organizations running Huly should verify availability of versions beyond 0.7.0 and confirm whether a fix is available. Deployment scope is typically internal or private team environments rather than public internet-facing services.

Exploitability

Exploitation requires valid user credentials to the Huly Platform. Once authenticated, an attacker can call or trigger the getAccountInfo endpoint with arbitrary user identifiers to retrieve unauthorized account information. No special privileges, complex exploitation chains, or user interaction are needed. Public disclosure of this vulnerability increases the likelihood of exploitation, as the affected code path is now documented in the CVE record. Attack complexity is low and attack vector is network-based.

Remediation

Update Huly Platform to a version newer than 0.7.0 once the vendor releases a patched version. Verify with hcengineering's release notes or security advisories that authorization checks within getAccountInfo have been remediated. In the interim, restrict Huly Platform access to trusted internal networks only, and monitor usage logs for unusual patterns of account information lookups. Consider implementing additional access controls at the application or network layer to limit lateral movement.

Patch guidance

Check hcengineering's official repository, release notes, and security advisories for patch availability beyond version 0.7.0. Given the vendor's non-responsiveness to early disclosure, patch timelines may be uncertain. Verify patch applicability to your deployment method (self-hosted, cloud, container) before deployment. Test patched versions in a staging environment to ensure compatibility with your workflow integrations. Document the patch date and version applied for compliance records.

Detection guidance

Monitor Huly Platform application logs for repeated calls to getAccountInfo or user information endpoints with varying account identifiers by the same authenticated user, especially if that user's role does not justify broad account enumeration. Set alerts on failed authorization events or access denial logs. If running Huly in a containerized or self-hosted environment, review audit trails and API gateway logs. Correlation of authentication logs with information retrieval patterns may reveal exploitation attempts. Deploy network detection rules to flag suspicious API patterns within the Huly application server.

Why prioritize this

Although the CVSS score of 4.3 (Medium) reflects limited blast radius due to authentication requirement and confidentiality-only impact, the combination of public exploit availability, vendor non-responsiveness, and ease of exploitation warrant prioritization. The vulnerability enables lateral reconnaissance and account enumeration, which often precedes targeted attacks. Organizations with security-sensitive workflows on Huly or strict data governance requirements should treat this as higher priority.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects a network-accessible vulnerability requiring valid authentication (PR:L), no user interaction, and limited scope with only confidentiality impact (C:L). The score appropriately penalizes the authentication requirement but does not fully capture organizational risk from account enumeration and data leakage in sensitive team environments. The public availability of exploit details and lack of vendor response elevate real-world risk beyond the baseline CVSS metric.

Frequently asked questions