CVE-2026-56769

HIGH8.5

Huly Platform - Server-Side Request Forgery via /import Endpoint

Published Jun 25, 2026

Modified 4 days ago

Details

Huly Platform through 0.7.423, fixed in commit 68cbf8a contains an authenticated server-side request forgery vulnerability in the /import endpoint of front pod that allows workspace users to make arbitrary server requests. Attackers can exploit this by supplying malicious URLs to fetch internal services, exfiltrate responses, and replay credentials against backend systems.

References

FIX

https://github.com/hcengineering/platform/commit/68cbf8a88642d8313f151a274fb5c24dee6a2762

DETECTION

https://github.com/hcengineering/platform/issues/10892

WEB

https://github.com/hcengineering/platform/pull/10910

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2026-56769

ADVISORY

https://www.vulncheck.com/advisories/huly-platform-server-side-request-forgery-via-import-endpoint

CVSS Analysis