CVE-2026-119650 Details

A vulnerability allowing insecure direct object reference has been identified in HuLa-Server versions through 3.0.7. This issue resides within the PrivacyController, where authenticated users can access and modify other users' privacy settings by providing the target user's ID (uid). The vulnerability arises because the application does not perform ownership checks, allowing any logged-in user to read and overwrite the UserPrivacy settings of others by sending GET or POST requests to the /privacy endpoint with a specified uid parameter.

The vulnerability can be addressed by modifying the PrivacyController to derive the uid from the authenticated user's context instead of accepting it as a request parameter. Additionally, implementing ownership checks in the PrivacyService before allowing any read or write operations on privacy settings will help prevent unauthorized access.