{"id":"CVE-2026-119650","kind":"vulnerability","aliases":["CVE-2026-119650"],"related":[],"title":"HuLa-Server: authenticated users can read and change other users' privacy settings","description":"HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in PrivacyController that allows authenticated users to access other users' privacy settings by supplying their uid. Attackers can send GET or POST requests to /privacy with a target uid parameter to read and overwrite that user's UserPrivacy settings without ownership checks.","summary":"HuLa-Server through version 3.0.7 has an insecure direct object reference in its privacy controller, so any logged-in user can supply another user's uid. An attacker can read and overwrite that user's privacy settings through requests to /privacy.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hula-server","other","self-hosted"],"not_affected_if":["auth-required"],"how_to_check":"- Check the HuLa-Server version in use; `unknown` whether it is 3.0.7 or earlier, per the sources.\n- Look for the PrivacyController endpoint `/privacy` in the deployed server and whether it checks ownership of the supplied uid; `unknown` whether the sources name a specific check.","fix":null,"status":"open","published_at":"2026-10-30T15:16:48+00:00","first_seen_at":"2026-10-30T15:31:10+00:00","triaged_at":"2026-10-30T15:33:36+00:00","updated_at":"2026-10-30T15:33:36+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-30T15:33:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"HuLa-Server: authenticated users can read and change other users' privacy settings","impact":"low","summary":"HuLa-Server through version 3.0.7 has an insecure direct object reference in its privacy controller, so any logged-in user can supply another user's uid. An attacker can read and overwrite that user's privacy settings through requests to /privacy.","audience":"businesses","category":"other","nicknames":[],"who_cares":["hula-server","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker reads and overwrites other users' privacy settings","analyst_note":"","how_to_check":"- Check the HuLa-Server version in use; `unknown` whether it is 3.0.7 or earlier, per the sources.\n- Look for the PrivacyController endpoint `/privacy` in the deployed server and whether it checks ownership of the supplied uid; `unknown` whether the sources name a specific check.","plain_action":"","needs_analyst":false,"not_affected_if":["auth-required"],"who_is_affected":"Teams running HuLa-Server through version 3.0.7 where users hold accounts on the same instance. Exposure depends on any authenticated user being able to reach the /privacy endpoint; the sources do not say whether network access is restricted. Deployments without multiple user accounts have less exposure.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000675,"input_tokens":4144,"output_tokens":521,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119650':16A,19A '-2026':15A,18A '/privacy':69B,106C '3.0.7':32B,74C 'access':89C 'allow':85C 'anoth':51B 'attack':56B,98C 'authent':4A,86C 'chang':9A 'check':123C 'contain':75C 'control':42B 'cve':14A,17A 'direct':36B,78C 'get':101C 'host':26B 'hula':2A,21B,28B,71C 'hula-serv':1A,20B,27B,70C 'insecur':35B,77C 'log':46B 'logged-in':45B 'object':37B,79C 'overwrit':60B,115C 'ownership':122C 'paramet':111C 'post':103C 'privaci':12A,41B,64B,92C 'privacycontrol':83C 'read':7A,58B,113C 'refer':38B,80C 'request':67B,104C 'self':25B 'self-host':24B 'send':100C 'server':3A,22B,29B,72C 'set':13A,65B,93C,120C 'suppli':50B,95C 'target':109C 'uid':54B,97C,110C 'user':5A,11A,48B,52B,62B,87C,91C,117C 'userprivaci':119C 'version':31B 'vulner':81C 'without':121C","nicknames":[],"mitigations":[],"who_affected":"Teams running HuLa-Server through version 3.0.7 where users hold accounts on the same instance. Exposure depends on any authenticated user being able to reach the /privacy endpoint; the sources do not say whether network access is restricted. Deployments without multiple user accounts have less exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T15:16:48+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119650","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119650","severity":null,"published_at":"2026-10-30T15:16:48+00:00","modified_at":"2026-10-30T15:16:48+00:00","first_seen_at":"2026-10-30T15:31:10+00:00","fetched_at":"2026-10-30T15:31:10+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}