CVE-2026-119651 Details

A vulnerability allowing insecure direct object reference (IDOR) has been identified in HuLa-Server versions through 3.0.7. This vulnerability exists in the FeedController.delFeed method, where authenticated users can delete moments belonging to other users. The issue arises from the lack of proper authorization checks, as the deletion is based solely on the feedId provided by the requester. Exploitation involves sending POST requests to the /feed/del endpoint with a target user's feedId, resulting in the deletion of the associated moment, including any media, comments, and likes.

The vulnerability can be addressed by implementing object-level authorization checks. This involves verifying that the user requesting the deletion is the owner of the moment or has explicit permission to delete it, before allowing the operation to proceed.