CVE-2026-12212: Huly Platform Auth Bypass Vulnerability

CVE-2026-12212 Overview

CVE-2026-12212 is an improper access control vulnerability in the hcengineering Huly Platform up to version 0.7.0. The flaw resides in the getMailboxSecret function within server/account/src/operations.ts, which is part of the platform's RPC Interface component. An authenticated remote attacker can abuse the function to retrieve mailbox secret material that should remain restricted. The exploit details have been publicly disclosed, increasing the likelihood of opportunistic abuse. According to the disclosure, the vendor was contacted in advance but did not respond, leaving Huly Platform deployments without an official fix at the time of publication.

Critical Impact
Authenticated remote attackers can invoke getMailboxSecret to access mailbox secrets belonging to other users, exposing confidential mail account credentials.

Affected Products

hcengineering Huly Platform versions up to and including 0.7.0
The server/account service exposing the RPC Interface
Deployments using the getMailboxSecret operation in operations.ts

Discovery Timeline

2026-06-15 - CVE-2026-12212 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-12212

Vulnerability Analysis

The Huly Platform is an open-source collaboration suite that includes an account service exposing mailbox operations through an RPC Interface. The vulnerable function getMailboxSecret returns secret material associated with a user's mailbox configuration. The function fails to enforce that the calling principal owns the requested mailbox or holds an administrative role.

Because the RPC endpoint is reachable over the network, any authenticated user with low privileges can issue a request for an arbitrary mailbox identifier. The server returns the corresponding secret without checking the requester's authorization context. This maps to [CWE-266] (Incorrect Privilege Assignment) and constitutes a Broken Access Control issue.

The disclosed EPSS probability is 0.207% at a percentile of 10.813, reflecting limited current exploitation telemetry. However, the public availability of exploit details raises the practical risk for exposed deployments.

Root Cause

The root cause is a missing authorization check inside getMailboxSecret in server/account/src/operations.ts. The handler trusts the supplied mailbox identifier and queries the underlying store without correlating it to the authenticated session. No role-based or ownership-based predicate is evaluated before returning the secret.

Attack Vector

An attacker authenticates to a Huly Platform instance with any valid low-privileged account. The attacker then issues an RPC call to getMailboxSecret referencing a victim mailbox identifier. The server returns the secret, which can be used to impersonate the mailbox owner or relay messages on their behalf.

No user interaction is required, and the attack is fully remote over the application's standard RPC channel. See the VulDB advisory for CVE-2026-12212 for further technical context.

Detection Methods for CVE-2026-12212

Indicators of Compromise

RPC calls to the getMailboxSecret operation originating from accounts that do not own the referenced mailbox
Unusual enumeration patterns iterating across mailbox identifiers from a single session or IP address
Mailbox secrets being read at a rate or volume inconsistent with legitimate client behavior

Detection Strategies

Enable verbose audit logging on the server/account service and alert on every getMailboxSecret invocation that crosses user boundaries
Correlate authenticated session identity with the mailboxId parameter at the application or reverse-proxy layer
Baseline normal RPC call frequency per user and flag statistical outliers indicative of secret harvesting

Monitoring Recommendations

Forward Huly Platform application logs to a centralized analytics pipeline for retroactive review
Monitor downstream mail systems for unexpected authentication using mailbox credentials sourced from the platform
Track newly created or low-tenure accounts that immediately exercise mailbox-related RPC endpoints

How to Mitigate CVE-2026-12212

Immediate Actions Required

Restrict network exposure of the Huly Platform RPC Interface to trusted networks and authenticated VPN clients
Disable or proxy-filter the getMailboxSecret operation until an authoritative patch is available from hcengineering
Rotate all mailbox secrets and credentials that may have been exposed through the vulnerable endpoint
Audit recent RPC traffic for any cross-tenant or cross-user invocations of mailbox operations

Patch Information

At the time of publication, no vendor patch has been released. The disclosing party reports that hcengineering did not respond to the coordinated disclosure attempt. Operators should monitor the Huly Platform repository for upstream fixes and consider applying a local hotfix that adds an ownership check inside getMailboxSecret before the function returns the secret.

Workarounds

Add a server-side authorization predicate that compares the authenticated principal to the owner of the requested mailbox before returning the secret
Deploy a reverse-proxy rule that denies RPC requests to getMailboxSecret when the session user does not match the target mailbox identifier
Limit account creation and require administrative approval to reduce the pool of low-privileged users who could abuse the endpoint
Segment the account service onto an internal network and require mutual TLS for RPC clients

bash

# Example reverse-proxy guard (nginx) to block cross-user getMailboxSecret calls
# Requires an auth subrequest that resolves the session user and target mailbox owner
location /rpc/getMailboxSecret {
    auth_request /authz/mailbox-owner-check;
    proxy_pass http://huly_account_backend;
}