---
id: "CVE-2026-119651"
kind: "vulnerability"
aliases: ["CVE-2026-119651"]
title: "HuLa-Server: authenticated users can delete other users' moments"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["hula-server", "other", "self-hosted"]
not_affected_if: ["no-user-accounts", "version-above-3.0.7"]
published_at: "2026-10-30T15:16:48+00:00"
first_seen_at: "2026-10-30T15:31:10+00:00"
updated_at: "2026-10-30T15:33:36+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119651", "first_seen_at": "2026-10-30T15:31:10+00:00"}]
---

# HuLa-Server: authenticated users can delete other users' moments

HuLa-Server through 3.0.7 lets any logged-in user delete other users' moments by sending their feedId to the delete endpoint. Deleting a moment also removes its media, comments and likes.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the HuLa-Server version in use; `3.0.7` and earlier are described as affected.
- Look for the `/feed/del` POST route and whether it checks that the feed belongs to the requesting user.

## Timeline

- 2026-10-30T15:31:10+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119651

## From the sources

HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FeedController.delFeed that allows authenticated users to delete other users' moments by supplying arbitrary feedId values. Attackers can send POST requests to /feed/del with another user's feedId to delete their moments along with associated media, comments, and likes.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_