Live › vulnerability › CVE-2026-119652
HuLa-Server through 3.0.7 has an insecure direct object reference in its friend list endpoint. An authenticated user can request another user's friend list by supplying that user's uid to /user/friend/page, because no owner or administrator check is made.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 15:31 UTC. All times on this page are UTC.
Teams running HuLa-Server through version 3.0.7 where ordinary accounts can log in. Exposure depends on whether the friend list endpoint returns other users' data to any authenticated caller. Deployments that do not run HuLa-Server can skip it.
No product ranges from the sources yet.
3.0.7/user/friend/page is reachable by ordinary logged-in usersFriendController.friendList validates that the requested uid belongs to the callerNo fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FriendController.friendList that allows authenticated users to view other users' friend lists by supplying a uid parameter. Attackers can send GET requests to /user/friend/page with a victim's uid, bypassing the missing administrator or owner check to read any user's contact list.
This page as .md · .json · in your agent: get_signal("CVE-2026-119652")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.