CVE-2026-119651: HuLa-Server through 3.0.7 IDOR via /feed/del Moment Deletion
HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FeedController.delFeed that allows authenticated users to delete other users' moments by supplying arbitrary feedId values. Attackers can send POST requests to /feed/del with another user's feedId to delete their moments along with associated media, comments, and likes.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated HuLa-Server user who can submit POST requests to /feed/del can exploit it. The attacker needs a feedId belonging to another user; no user interaction is required.
What data or functionality is affected by a successful attack?
An attacker can delete another user's moment. The deletion also removes associated media, comments, and likes.
Are unauthenticated deployments exposed?
The described attack requires authentication, so an unauthenticated attacker is not described as able to exploit it directly. Any account with access to the affected endpoint should be treated as capable of attempting the deletion.