{"id":"CVE-2026-119651","kind":"vulnerability","aliases":["CVE-2026-119651"],"related":[],"title":"HuLa-Server: authenticated users can delete other users' moments","description":"HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FeedController.delFeed that allows authenticated users to delete other users' moments by supplying arbitrary feedId values. Attackers can send POST requests to /feed/del with another user's feedId to delete their moments along with associated media, comments, and likes.","summary":"HuLa-Server through 3.0.7 lets any logged-in user delete other users' moments by sending their feedId to the delete endpoint. Deleting a moment also removes its media, comments and likes.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hula-server","other","self-hosted"],"not_affected_if":["no-user-accounts","version-above-3.0.7"],"how_to_check":"- Check the HuLa-Server version in use; `3.0.7` and earlier are described as affected.\n- Look for the `/feed/del` POST route and whether it checks that the feed belongs to the requesting user.","fix":null,"status":"open","published_at":"2026-10-30T15:16:48+00:00","first_seen_at":"2026-10-30T15:31:10+00:00","triaged_at":"2026-10-30T15:33:36+00:00","updated_at":"2026-10-30T15:33:36+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-30T15:33:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"HuLa-Server: authenticated users can delete other users' moments","impact":"medium","summary":"HuLa-Server through 3.0.7 lets any logged-in user delete other users' moments by sending their feedId to the delete endpoint. Deleting a moment also removes its media, comments and likes.","audience":"businesses","category":"other","nicknames":[],"who_cares":["hula-server","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"Other users' moments, media, comments and likes are deleted","analyst_note":"","how_to_check":"- Check the HuLa-Server version in use; `3.0.7` and earlier are described as affected.\n- Look for the `/feed/del` POST route and whether it checks that the feed belongs to the requesting user.","plain_action":"","needs_analyst":false,"not_affected_if":["version-above-3.0.7","no-user-accounts"],"who_is_affected":"Teams running HuLa-Server 3.0.7 or earlier where users have accounts. The flaw is in the moments delete path, so deployments without the moments feature or with only trusted users are less exposed. The sources do not say whether a patched version exists.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000649,"input_tokens":4144,"output_tokens":469,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119651':13A,16A '-2026':12A,15A '/feed/del':91C '3.0.7':28B,61C 'allow':72C 'along':101C 'also':50B 'anoth':93C 'arbitrari':82C 'associ':103C 'attack':85C 'authent':4A,73C 'comment':54B,105C 'contain':62C 'cve':11A,14A 'delet':7A,35B,45B,47B,76C,98C 'direct':65C 'endpoint':46B 'feedcontroller.delfeed':70C 'feedid':42B,83C,96C 'host':23B 'hula':2A,18B,25B,58C 'hula-serv':1A,17B,24B,57C 'insecur':64C 'let':29B 'like':56B,107C 'log':32B 'logged-in':31B 'media':53B,104C 'moment':10A,38B,49B,79C,100C 'object':66C 'post':88C 'refer':67C 'remov':51B 'request':89C 'self':22B 'self-host':21B 'send':40B,87C 'server':3A,19B,26B,59C 'suppli':81C 'user':5A,9A,34B,37B,74C,78C,94C 'valu':84C 'vulner':68C","nicknames":[],"mitigations":[],"who_affected":"Teams running HuLa-Server 3.0.7 or earlier where users have accounts. The flaw is in the moments delete path, so deployments without the moments feature or with only trusted users are less exposed. The sources do not say whether a patched version exists.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T15:16:48+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119651","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119651","severity":null,"published_at":"2026-10-30T15:16:48+00:00","modified_at":"2026-10-30T15:16:48+00:00","first_seen_at":"2026-10-30T15:31:10+00:00","fetched_at":"2026-10-30T15:31:10+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}