CVE-2026-119652 Details
Description
HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FriendController.friendList that allows authenticated users to view other users' friend lists by supplying a uid parameter. Attackers can send GET requests to /user/friend/page with a victim's uid, bypassing the missing administrator or owner check to read any user's contact list.
A vulnerability allowing insecure direct object reference (IDOR) has been identified in HuLa-Server versions through 3.0.7. This vulnerability resides in the FriendController, specifically within the friendList method. It enables authenticated users to access other users' friend lists by manipulating the uid parameter. Attackers can exploit this by sending GET requests to /user/friend/page with a targeted uid, circumventing the absence of proper checks to verify ownership or administrative rights, and thereby gaining unauthorized access to any user's contact list.
Users are advised to update to HuLa-Server version 3.0.8 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Nov 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://hackmd.io/@hieuPenguinnn/hula-server-idor-privacy-feed-friend | CISA-ADP | ExploitTechnical Analysis |
| https://github.com/HuLaSpark/HuLa-Server | [email protected] | ProductSource CodeVendor |
| https://github.com/HuLaSpark/HuLa-Server/blob/v3.0.7/luohuo-cloud/luohuo-im/luohuo-im-controller/src/main/java/com/luohuo/flex/im/controller/user/FriendController.java#L59-L66 | [email protected] | Source CodeVendor |
| https://github.com/HuLaSpark/HuLa-Server/issues/34 | [email protected] | ExploitIssue TrackingTechnical AnalysisVendor |
| https://hackmd.io/@hieuPenguinnn/hula-server-idor-privacy-feed-friend | [email protected] | ExploitTechnical Analysis |
| https://www.vulncheck.com/advisories/hula-server-through-3.0.7-idor-via-user-friend-page-friend-list-disclosure | [email protected] | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| HuLaSpark HuLa-Server | <= 3.0.7 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 5, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | [email protected] |