Insecure Direct Object Reference in HuLa-Server Affects User Moment Deletion
CVE-2026-119651

5.3MEDIUM

Key Information:

Vendor

Hulaspark

Status
Hula-server
Vendor
CVE Published:
30 October 2026

What is CVE-2026-119651?

HuLa-Server versions up to 3.0.7 exhibit a critical vulnerability that allows authenticated users to exploit insecure direct object reference issues. By manipulating the feedId values, attackers can send crafted POST requests to the /feed/del endpoint to delete the moments of other users, as well as their associated media, comments, and likes. This vulnerability poses significant risks to user privacy and data integrity.

Affected Version(s)

HuLa-Server 0 <= 3.0.7

References

https://github.com/HuLaSpark/HuLa-Server/issues/34
issue-tracking
https://github.com/HuLaSpark/HuLa-Server/blob/v3.0.7/luoh...
technical-description
https://github.com/HuLaSpark/HuLa-Server/blob/v3.0.7/luoh...
technical-description

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hieuPenguinnn
.