CVE-2026-119651

HuLa-Server through 3.0.7 IDOR via /feed/del Moment Deletion

State: Published
Severity: 5.3 Medium
Published: Oct 30, 2026
Updated: Oct 30, 2026
Reserved: Oct 30, 2026

Description

HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FeedController.delFeed that allows authenticated users to delete other users' moments by supplying arbitrary feedId values. Attackers can send POST requests to /feed/del with another user's feedId to delete their moments along with associated media, comments, and likes.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N	VulnCheck
3.1	5.4 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L	VulnCheck

Weaknesses

CWE-639 Authorization Bypass Through User-Controlled Key

Affected Products

Product	Versions
HuLa-ServerHuLaSpark	3.0.7 and earlierAffected

References

https://github.com/HuLaSpark/HuLa-Server/issues/34issue-tracking
https://github.com/HuLaSpark/HuLa-Server/blob/v3.0.7/luohuo-cloud/luohuo-im/luohuo-im-controller/src/main/java/com/luohuo/flex/im/controller/user/FeedController.java#L79-L83technical-description
https://github.com/HuLaSpark/HuLa-Server/blob/v3.0.7/luohuo-cloud/luohuo-im/luohuo-im-biz/src/main/java/com/luohuo/flex/im/core/user/service/impl/FeedServiceImpl.java#L356-L370technical-description
https://hackmd.io/@hieuPenguinnn/hula-server-idor-privacy-feed-friendthird-party-advisory
https://github.com/HuLaSpark/HuLa-Serverproduct
VulnCheck Advisory: HuLa-Server through 3.0.7 IDOR via /feed/del Moment Deletionthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.