HuLaSpark HuLa-Server up to 3.0.7 FeedController FeedController.delFeed feedId resource injection

Summaryinfo

A vulnerability has been found in HuLaSpark HuLa-Server up to 3.0.7 and classified as problematic. Affected is the function FeedController.delFeed of the component FeedController. The manipulation of the argument feedId leads to resource injection. This vulnerability is documented as CVE-2026-119651. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in HuLaSpark HuLa-Server up to 3.0.7. This issue affects the function FeedController.delFeed of the component FeedController. The manipulation of the argument feedId with an unknown input leads to a resource injection vulnerability. Using CWE to declare the problem leads to CWE-99. The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control. Impacted is integrity, and availability. The summary by CVE is:

HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FeedController.delFeed that allows authenticated users to delete other users' moments by supplying arbitrary feedId values. Attackers can send POST requests to /feed/del with another user's feedId to delete their moments along with associated media, comments, and likes.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-119651 since 10/30/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 10/30/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• HuLaSpark

Name

• HuLa-Server

Version

• 3.0.0
• 3.0.1
• 3.0.2
• 3.0.3
• 3.0.4
• 3.0.5
• 3.0.6
• 3.0.7

Website

• Product: https://github.com/HuLaSpark/HuLa-Server/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion