HuLa-Server IDOR in PrivacyController exposes other users' privacy settings
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.
Summary
HuLa-Server through 3.0.7 contains an insecure direct object reference in PrivacyController (CVE-2026-119650, CWE-639, Authorization Bypass Through User-Controlled Key). An authenticated user can supply another user's uid to GET or POST /privacy and read or overwrite that user's UserPrivacy settings, because the endpoint performs no ownership check. The CVSS 4.0 base score is 5.3 (MEDIUM).
Written with Claude Haiku 5.5 from the sources below · 2026-10-30
Description from the CNA
HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in PrivacyController that allows authenticated users to access other users' privacy settings by supplying their uid. Attackers can send GET or POST requests to /privacy with a target uid parameter to read and overwrite that user's UserPrivacy settings without ownership checks.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
No fixed version is listed for HuLa-Server through 3.0.7, so no patched release is confirmed. Until one is available, block requests to /privacy that name a uid other than the caller's own, and verify that the server enforces ownership before returning or changing UserPrivacy settings.
Written with Claude Haiku 5.5 from the sources below · 2026-10-30
Timeline
- 2026-10-30 Threatist record created from CVE-2026-119650
- 2026-10-30 Alias added: GHSA-qjr3-64xh-cvgf
- 2026-10-30 CISA SSVC decision points changed
References
Other 4
- https://github.com/HuLaSpark/HuLa-Server/issues/34
- https://github.com/HuLaSpark/HuLa-Server/blob/v3.0.7/luohuo-cloud/luohuo-im/luohuo-im-controller/src/main/java/com/luohuo/flex/im/controller/user/PrivacyController.java#L25-L36
- https://github.com/HuLaSpark/HuLa-Server/blob/v3.0.7/luohuo-cloud/luohuo-im/luohuo-im-biz/src/main/java/com/luohuo/flex/im/core/user/service/impl/PrivacyServiceImpl.java#L20-L35
- https://github.com/HuLaSpark/HuLa-Server
More HuLaSpark vulnerabilities
- TI-2026-83126 Insecure direct object reference in HuLa-Server exposes friend lists CVSS 4.0MEDIUM 5.3
- TI-2026-83125 HuLa-Server lets users delete other users' moments via feed endpoint CVSS 4.0MEDIUM 5.3
Sources
- CVE-2026-119650 · CVE Program
- CVE-2026-119650 · NVD
- FIRST EPSS
- GHSA-qjr3-64xh-cvgf · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences