{"id":"CVE-2026-119652","kind":"vulnerability","aliases":["CVE-2026-119652"],"related":[],"title":"HuLa-Server: any logged-in user can read other users' friend lists","description":"HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FriendController.friendList that allows authenticated users to view other users' friend lists by supplying a uid parameter. Attackers can send GET requests to /user/friend/page with a victim's uid, bypassing the missing administrator or owner check to read any user's contact list.","summary":"HuLa-Server through 3.0.7 has an insecure direct object reference in its friend list endpoint. An authenticated user can request another user's friend list by supplying that user's uid to /user/friend/page, because no owner or administrator check is made.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hula-server","java","runtime","self-hosted"],"not_affected_if":["auth-required-with-owner-check","not-running-hula-server"],"how_to_check":"- Confirm whether HuLa-Server is deployed and check its version against `3.0.7`\n- Review whether `/user/friend/page` is reachable by ordinary logged-in users\n- Check whether the friend list handler in `FriendController.friendList` validates that the requested uid belongs to the caller","fix":null,"status":"open","published_at":"2026-10-30T15:16:48+00:00","first_seen_at":"2026-10-30T15:31:10+00:00","triaged_at":"2026-10-30T15:33:42+00:00","updated_at":"2026-10-30T15:33:42+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-30T15:33:42Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"HuLa-Server: any logged-in user can read other users' friend lists","impact":"medium","summary":"HuLa-Server through 3.0.7 has an insecure direct object reference in its friend list endpoint. An authenticated user can request another user's friend list by supplying that user's uid to /user/friend/page, because no owner or administrator check is made.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["hula-server","self-hosted","java"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"any logged-in user reads other users' contact lists","analyst_note":"Confirm the fixed version and whether a patch exists by checking the NVD entry and the HuLa-Server repository advisories.","how_to_check":"- Confirm whether HuLa-Server is deployed and check its version against `3.0.7`\n- Review whether `/user/friend/page` is reachable by ordinary logged-in users\n- Check whether the friend list handler in `FriendController.friendList` validates that the requested uid belongs to the caller","plain_action":"","needs_analyst":true,"not_affected_if":["not-running-hula-server","auth-required-with-owner-check"],"who_is_affected":"Teams running HuLa-Server through version 3.0.7 where ordinary accounts can log in. Exposure depends on whether the friend list endpoint returns other users' data to any authenticated caller. Deployments that do not run HuLa-Server can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000696,"input_tokens":4146,"output_tokens":563,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119652':17A,20A '-2026':16A,19A '/user/friend/page':62B,106C '3.0.7':33B,75C 'administr':67B,115C 'allow':86C 'anoth':50B 'attack':100C 'authent':46B,87C 'bypass':112C 'check':68B,118C 'contact':124C 'contain':76C 'cve':15A,18A 'direct':37B,79C 'endpoint':44B 'friend':13A,42B,53B,93C 'friendcontroller.friendlist':84C 'get':103C 'host':28B 'hula':2A,22B,30B,72C 'hula-serv':1A,21B,29B,71C 'insecur':36B,78C 'java':24B 'list':14A,43B,54B,94C,125C 'log':6A 'logged-in':5A 'made':70B 'miss':114C 'object':38B,80C 'owner':65B,117C 'paramet':99C 'read':10A,120C 'refer':39B,81C 'request':49B,104C 'runtim':25B 'self':27B 'self-host':26B 'send':102C 'server':3A,23B,31B,73C 'suppli':56B,96C 'uid':60B,98C,111C 'user':8A,12A,47B,51B,58B,88C,92C,122C 'victim':109C 'view':90C 'vulner':82C","nicknames":[],"mitigations":[],"who_affected":"Teams running HuLa-Server through version 3.0.7 where ordinary accounts can log in. Exposure depends on whether the friend list endpoint returns other users' data to any authenticated caller. Deployments that do not run HuLa-Server can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T15:16:48+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119652","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119652","severity":null,"published_at":"2026-10-30T15:16:48+00:00","modified_at":"2026-10-30T15:16:48+00:00","first_seen_at":"2026-10-30T15:31:10+00:00","fetched_at":"2026-10-30T15:31:10+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}