CVE-2026-119650
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in PrivacyController that allows authenticated users to access other users' privacy settings by supplying their uid. An attacker can send GET or POST requests to /privacy with a target uid parameter to read and overwrite that user's UserPrivacy settings without ownership checks.
Risk Assessment
An attacker can read and modify other users' privacy settings, breaching their privacy and control over data. Only an authenticated account is required.
Recommendation
Upgrade HuLa-Server to a version later than 3.0.7. Add an account ownership check before reading or modifying privacy settings.
Other vulnerabilities in HuLa-Server
See all- CVE-2026-119652Medium
HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FriendController.friendList that allows authenticated users to view other users' friend lists by supplying a uid parameter. An attacker can send GET requests to /user/friend/page with a victim's uid, bypassing the missing administrator or owner check to read any user's contact list.
- CVE-2026-119651Medium
HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FeedController.delFeed that allows authenticated users to delete other users' moments by supplying arbitrary feedId values. An attacker can send POST requests to /feed/del with another user's feedId to delete their moments along with associated media, comments, and likes.
Original NVD description (English source)
HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in PrivacyController that allows authenticated users to access other users' privacy settings by supplying their uid. Attackers can send GET or POST requests to /privacy with a target uid parameter to read and overwrite that user's UserPrivacy settings without ownership checks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS