CVE-2026-119651 | BDVDB-2026-398558 Detail
HuLaSparkHuLa-Server
Description#
HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FeedController.delFeed that allows authenticated users to delete other users' moments by supplying arbitrary feedId values. Attackers can send POST requests to /feed/del with another user's feedId to delete their moments along with associated media, comments, and likes.
Impact#
Per CVSS v3.1: confidentiality impact none, integrity impact low, availability impact low. Attack vector: network.
Weaknesses#
- CWE-639 Authorization Bypass Through User-Controlled Key
References#
- https://github.com/HuLaSpark/HuLa-Server/issues/34
- https://github.com/HuLaSpark/HuLa-Server/blob/v3.0.7/luohuo-cloud/luohuo-im/luohuo-im-controller/src/main/java/com/luohuo/flex/im/controller/user/FeedController.java#L79-L83
- https://github.com/HuLaSpark/HuLa-Server/blob/v3.0.7/luohuo-cloud/luohuo-im/luohuo-im-biz/src/main/java/com/luohuo/flex/im/core/user/service/impl/FeedServiceImpl.java#L356-L370
- https://hackmd.io/@hieuPenguinnn/hula-server-idor-privacy-feed-friend
- https://github.com/HuLaSpark/HuLa-Server
- https://www.vulncheck.com/advisories/hula-server-through-3.0.7-idor-via-feed-del-moment-deletion
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.