HuLa-Server vulnerabilities
CVEs whose affected-version data names the HuLa-Server package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
3 CVEsRSS
CVE-2026-119651Medium· 5.4HuLa-Server through 3.0.7 IDOR via /feed/del Moment Deletion
HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FeedController.delFeed that allows authenticated users to delete other users' moments by supplying arbitrary feedId values. Attackers can send POST r…
CVE-2026-119650Medium· 5.4HuLa-Server through 3.0.7 IDOR via /privacy Endpoint in PrivacyController
HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in PrivacyController that allows authenticated users to access other users' privacy settings by supplying their uid. Attackers can send GET or POST requ…
CVE-2026-119652Medium· 4.3PoCHuLa-Server through 3.0.7 IDOR via /user/friend/page Friend List Disclosure
HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FriendController.friendList that allows authenticated users to view other users' friend lists by supplying a uid parameter. Attackers can send GET re…