Insecure Direct Object Reference in HuLa-Server Affects User Privacy Settings

CVE-2026-119650

What is CVE-2026-119650?

HuLa-Server versions up to and including 3.0.7 are susceptible to an insecure direct object reference vulnerability within the PrivacyController component. This vulnerability allows authenticated users to manipulate and access the privacy settings of other users by providing their unique user ID (uid) in GET or POST requests to the /privacy endpoint. The lack of necessary ownership checks enables attackers to both read and potentially alter the UserPrivacy settings of other accounts, compromising user data security and privacy within the application.

References