CVE-2026-119652 in HuLa-Server
Summary
by MITRE • 10/30/2026
HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FriendController.friendList that allows authenticated users to view other users' friend lists by supplying a uid parameter. Attackers can send GET requests to /user/friend/page with a victim's uid, bypassing the missing administrator or owner check to read any user's contact list.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.