Live › vulnerability › CVE-2026-119650
HuLa-Server through version 3.0.7 has an insecure direct object reference in its privacy controller, so any logged-in user can supply another user's uid. An attacker can read and overwrite that user's privacy settings through requests to /privacy.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 15:31 UTC. All times on this page are UTC.
Teams running HuLa-Server through version 3.0.7 where users hold accounts on the same instance. Exposure depends on any authenticated user being able to reach the /privacy endpoint; the sources do not say whether network access is restricted. Deployments without multiple user accounts have less exposure.
No product ranges from the sources yet.
unknown whether it is 3.0.7 or earlier, per the sources./privacy in the deployed server and whether it checks ownership of the supplied uid; unknown whether the sources name a specific check.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in PrivacyController that allows authenticated users to access other users' privacy settings by supplying their uid. Attackers can send GET or POST requests to /privacy with a target uid parameter to read and overwrite that user's UserPrivacy settings without ownership checks.
This page as .md · .json · in your agent: get_signal("CVE-2026-119650")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.