PT-2026-49174 · Unknown · Huly Platform

Geochen · CVE-2026-12212 · Published 2026-06-15 · Updated 2026-06-15

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Huly Platform versions prior to 0.7.1

Description Improper access controls in the RPC Interface component allow for remote attacks. The issue is located in the getMailboxSecret() function within the server/account/src/operations.ts file.

Recommendations Update to a version later than 0.7.0. As a temporary workaround, restrict access to the getMailboxSecret() function.

Fix

Incorrect Privilege Assignment

Improper Access Control

Weakness Enumeration

CWE-266

CWE-284

Related Identifiers

CVE-2026-12212

Affected Products

Huly Platform

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-12212 · Security Note
• https://vuldb.com/cve/CVE-2026-12212 · Note
• https://vuldb.com/submit/832973 · Note
• https://twitter.com/VulmonFeeds/status/2066441719126647082 · Twitter Post
• https://vuldb.com/vuln/370854/cti · Note
• https://t.me/CVEtracker/56833 · Telegram Post
• https://vuldb.com/vuln/370854 · Note