EUVD-2026-114066 reports insecure object reference in HuLa-Server privacy settings
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- HuLaSpark
- Product
- HuLa-Server
- First seen
Summary
The EUVD entry, shared on Mastodon, says HuLa-Server through 3.0.7 has an insecure direct object reference that lets authenticated users read other users' privacy settings by supplying a uid. It assigns a CVSS v3.1 score of 5.3.
If you use HuLaSpark
Check HuLaSpark for a fixed HuLa-Server release and upgrade past 3.0.7
Restrict access to the server until patched
Review logs for requests to the privacy endpoints
Review recent deletions of user moments for unexpected activity
Review logs for friend-list requests using foreign uid values
What the sources say 3
· Mastodon: “HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FriendController.friendList that allows authenticated users to view other users' friend lists by supplying a uid parameter.” Source
· Mastodon: “HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FeedController.delFeed that allows authenticated users to delete other users' moments by supplying arbitrary feedId values.” Source
· Mastodon: “HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in PrivacyController that allows authenticated users to access other users' privacy settings by supplying their uid.” Source