CVE-2026-119650
mediumHuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in PrivacyController that allows authenticated users to access other users…
HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in PrivacyController that allows authenticated users to access other users' privacy settings by supplying their uid. Attackers can send GET or POST requests to /privacy with a target uid parameter to read and overwrite that user's UserPrivacy settings without ownership checks.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/HuLaSpark/HuLa-Server disclosure@vulncheck.com
- https://github.com/HuLaSpark/HuLa-Server/blob/v3.0.7/luohuo-cloud/luohuo-im/luohuo-im-biz/... disclosure@vulncheck.com
- https://github.com/HuLaSpark/HuLa-Server/blob/v3.0.7/luohuo-cloud/luohuo-im/luohuo-im-cont... disclosure@vulncheck.com
- https://github.com/HuLaSpark/HuLa-Server/issues/34 disclosure@vulncheck.com
- https://hackmd.io/@hieuPenguinnn/hula-server-idor-privacy-feed-friend disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/hula-server-through-3.0.7-idor-via-privacy-endpoint-i... disclosure@vulncheck.com