Live › vulnerability › CVE-2026-119651
HuLa-Server through 3.0.7 lets any logged-in user delete other users' moments by sending their feedId to the delete endpoint. Deleting a moment also removes its media, comments and likes.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 15:31 UTC. All times on this page are UTC.
Teams running HuLa-Server 3.0.7 or earlier where users have accounts. The flaw is in the moments delete path, so deployments without the moments feature or with only trusted users are less exposed. The sources do not say whether a patched version exists.
No product ranges from the sources yet.
3.0.7 and earlier are described as affected./feed/del POST route and whether it checks that the feed belongs to the requesting user.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FeedController.delFeed that allows authenticated users to delete other users' moments by supplying arbitrary feedId values. Attackers can send POST requests to /feed/del with another user's feedId to delete their moments along with associated media, comments, and likes.
This page as .md · .json · in your agent: get_signal("CVE-2026-119651")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.