CVE-2026-119650

HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in PrivacyController that allows authenticated users to access other users' privacy settings by supplying their uid. Attackers can send GET or POST requests to /privacy with a target uid parameter to read and...

CVE-2026-119650 HuLa-Server through 3.0.7 IDOR via /privacy Endpoint in PrivacyController

HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in PrivacyController that allows authenticated users to access other users' privacy settings by supplying their uid. Attackers can send GET or POST requests to /privacy with a target uid parameter to read and...

CVE-2026-119650

HuLa-Server version 3.0.7 and earlier is vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability within the PrivacyController component. The issue exists because the system fails to perform adequate ownership checks when processing requests to the /privacy endpoint. This allows aut...

CVE-2026-119650 HuLa-Server through 3.0.7 IDOR via /privacy Endpoint in PrivacyController

HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in PrivacyController that allows authenticated users to access other users' privacy settings by supplying their uid. Attackers can send GET or POST requests to /privacy with a target uid parameter to read and...

EUVD-2026-114066

HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in PrivacyController that allows authenticated users to access other users' privacy settings by supplying their uid. Attackers can send GET or POST requests to /privacy with a target uid parameter to read and...

PT-2026-133580

HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in PrivacyController that allows authenticated users to access other users' privacy settings by supplying their uid. Attackers can send GET or POST requests to /privacy with a target uid parameter to read and...

CVE-2026-119650: HuLaSpark HuLa-Server: HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in PrivacyController that allows…

HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in PrivacyController that allows authenticated users to access other users' privacy settings by supplying their uid. Attackers can send GET or POST requests to /privacy with a target uid parameter to read and...