---
id: "CVE-2026-119650"
kind: "vulnerability"
aliases: ["CVE-2026-119650"]
title: "HuLa-Server: authenticated users can read and change other users' privacy settings"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["hula-server", "other", "self-hosted"]
not_affected_if: ["auth-required"]
published_at: "2026-10-30T15:16:48+00:00"
first_seen_at: "2026-10-30T15:31:10+00:00"
updated_at: "2026-10-30T15:33:36+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119650", "first_seen_at": "2026-10-30T15:31:10+00:00"}]
---

# HuLa-Server: authenticated users can read and change other users' privacy settings

HuLa-Server through version 3.0.7 has an insecure direct object reference in its privacy controller, so any logged-in user can supply another user's uid. An attacker can read and overwrite that user's privacy settings through requests to /privacy.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the HuLa-Server version in use; `unknown` whether it is 3.0.7 or earlier, per the sources.
- Look for the PrivacyController endpoint `/privacy` in the deployed server and whether it checks ownership of the supplied uid; `unknown` whether the sources name a specific check.

## Timeline

- 2026-10-30T15:31:10+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119650

## From the sources

HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in PrivacyController that allows authenticated users to access other users' privacy settings by supplying their uid. Attackers can send GET or POST requests to /privacy with a target uid parameter to read and overwrite that user's UserPrivacy settings without ownership checks.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_