Summary
Huly Platform contains a missing authorization check in the account RPC used to merge person records. Any authenticated user who knows two person UUIDs may merge records in a way that attaches attacker-controlled, unverified social identifiers to another person, potentially enabling account takeover through login or password recovery.
Huly Platform contains a missing authorization check in the account RPC used to merge person records. Any authenticated user who knows two person UUIDs may merge records in a way that attaches attacker-controlled, unverified social identifiers to another person, potentially enabling account takeover through login or password recovery.
Affected context
The vulnerability occurs in Huly Platform deployments through version 0.7.432 where the mergeSpecifiedPersons account RPC is accessible to authenticated users without sufficient ownership or administrative authorization checks. Risk is greatest when person UUIDs are discoverable or obtainable and the merged identity data is later trusted by authentication or account-recovery workflows.
The vulnerability occurs in Huly Platform deployments through version 0.7.432 where the mergeSpecifiedPersons account RPC is accessible to authenticated users without sufficient ownership or administrative authorization checks. Risk is greatest when person UUIDs are discoverable or obtainable and the merged identity data is later trusted by authentication or account-recovery workflows.
Exploit preconditions
- Attack surface: The authenticated account-management RPC interface
- Required access: A valid Huly user account and knowledge of two person UUIDs
- Trigger point: Invocation of the person-merging operation
- Why exploitation is possible: The server does not adequately verify that the caller is authorized to merge the specified person records, allowing identity data to be associated with a victim account
- Attack surface: The authenticated account-management RPC interface
- Required access: A valid Huly user account and knowledge of two person UUIDs
- Trigger point: Invocation of the person-merging operation
- Why exploitation is possible: The server does not adequately verify that the caller is authorized to merge the specified person records, allowing identity data to be associated with a victim account
Why this happens
The underlying bug is an authorization failure in a state-changing account operation. The application permits an authenticated caller to merge person records without enforcing object-level ownership, role-based permissions, or equivalent administrative authorization for both records. This maps to CWE-862: Missing Authorization, where access control is absent or insufficient for a protected action.
The underlying bug is an authorization failure in a state-changing account operation. The application permits an authenticated caller to merge person records without enforcing object-level ownership, role-based permissions, or equivalent administrative authorization for both records. This maps to CWE-862: Missing Authorization, where access control is absent or insufficient for a protected action.
Potential impact
- An attacker may attach unverified social identifiers to another user's person record
- Victim accounts could be taken over through supported login flows
- Password-recovery processes could be redirected or abused
- Account identity and profile data could be corrupted
- Organizations may experience unauthorized access to user-associated resources
- An attacker may attach unverified social identifiers to another user's person record
- Victim accounts could be taken over through supported login flows
- Password-recovery processes could be redirected or abused
- Account identity and profile data could be corrupted
- Organizations may experience unauthorized access to user-associated resources
General mitigation guidance
Mitigation generally focuses on enforcing authorization at the server-side operation boundary and reducing trust in identity-linking data.
Common defensive patterns include:
- Require explicit administrative or ownership authorization before merging either person record
- Verify authorization independently for the source and destination identities
- Do not treat unverified social identifiers as sufficient authentication factors
- Require strong reauthentication or user confirmation for identity changes and account merges
- Apply object-level access-control policies consistently across RPC and API paths
- Limit account-recovery actions to verified, independently bound recovery factors
- Record and alert on unusual person merges and identity-provider changes
Mitigation generally focuses on enforcing authorization at the server-side operation boundary and reducing trust in identity-linking data.
Common defensive patterns include:
- Require explicit administrative or ownership authorization before merging either person record
- Verify authorization independently for the source and destination identities
- Do not treat unverified social identifiers as sufficient authentication factors
- Require strong reauthentication or user confirmation for identity changes and account merges
- Apply object-level access-control policies consistently across RPC and API paths
- Limit account-recovery actions to verified, independently bound recovery factors
- Record and alert on unusual person merges and identity-provider changes
How teams detect issues like this
Organizations can look for this class of issue through:
- Static analysis and code review checks for state-changing RPCs lacking authorization guards
- Tests that attempt cross-user object operations with authenticated, non-privileged accounts
- Review of identity-linking and account-recovery flows for reliance on unverified attributes
- Audit-log monitoring for unexpected person merges, social-identity attachments, or recovery events
- Policy enforcement requiring centralized object-level authorization for sensitive account operations
- Automated security review tools that identify missing permission checks on mutation endpoints
Organizations can look for this class of issue through:
- Static analysis and code review checks for state-changing RPCs lacking authorization guards
- Tests that attempt cross-user object operations with authenticated, non-privileged accounts
- Review of identity-linking and account-recovery flows for reliance on unverified attributes
- Audit-log monitoring for unexpected person merges, social-identity attachments, or recovery events
- Policy enforcement requiring centralized object-level authorization for sensitive account operations
- Automated security review tools that identify missing permission checks on mutation endpoints
