CVE-2026-119651
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FeedController.delFeed that allows authenticated users to delete other users' moments by supplying arbitrary feedId values. An attacker can send POST requests to /feed/del with another user's feedId to delete their moments along with associated media, comments, and likes.
Risk Assessment
An attacker can delete other users' moments and associated data, causing data loss and integrity violations. Only an authenticated account is required.
Recommendation
Upgrade HuLa-Server to a version later than 3.0.7. Add an ownership check on the feed before performing the delete operation.
Other vulnerabilities in HuLa-Server
See all- CVE-2026-119652Medium
HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FriendController.friendList that allows authenticated users to view other users' friend lists by supplying a uid parameter. An attacker can send GET requests to /user/friend/page with a victim's uid, bypassing the missing administrator or owner check to read any user's contact list.
- CVE-2026-119650Medium
HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in PrivacyController that allows authenticated users to access other users' privacy settings by supplying their uid. An attacker can send GET or POST requests to /privacy with a target uid parameter to read and overwrite that user's UserPrivacy settings without ownership checks.
Original NVD description (English source)
HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FeedController.delFeed that allows authenticated users to delete other users' moments by supplying arbitrary feedId values. Attackers can send POST requests to /feed/del with another user's feedId to delete their moments along with associated media, comments, and likes.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS