CVE-2026-119651

MediumCVSS 5.4/10Last modified Nov 4, 2026

Description

HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FeedController.delFeed that allows authenticated users to delete other users' moments by supplying arbitrary feedId values. Attackers can send POST requests to /feed/del with another user's feedId to delete their moments along with associated media, comments, and likes.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-639

Affected software

Vendor	Product	Versions
HuLaSpark	HuLa-Server	<= 3.0.7

References

Timeline

Published: Oct 30, 2026
Last modified: Nov 4, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1196524.3HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FriendController.friendList that allows authenticate CVE-2026-1196534.3Nging through 5.3.5 contains an information disclosure vulnerability that allows any authenticated backend user to list host directories by CVE-2026-1196548.8DataCap through 2025.1.1 contains a missing authorization vulnerability that allows any authenticated user to escalate privileges by calling CVE-2026-1196557.5CoreShop through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Good/GetGoodsPageList endpoint via the unvalidated CVE-2026-1196567.5CoreShop by CoreUnion through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Agent/GetGoodsPageList endpoint via t CVE-2026-1196575.0FilePress through 3.0.1 contains a missing authorization vulnerability in dzz/pichome/library that allows authenticated users to manage othe CVE-2026-1196584.3PowerDNS-Admin through 2026.08.1 contains an authorization bypass vulnerability that allows authenticated User-role accounts to refresh seco CVE-2026-1196595.4Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated users to access other users' folders because CVE-2026-119665.3The User Registration & Membership WordPress plugin before 5.2.3 does not perform a capability check for unauthenticated callers on one of CVE-2026-1196609.8MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin sessions by using CVE-2026-1196614.2ShowDoc through 3.9.5 contains an authorization bypass vulnerability in the api/paramDescLib/deleteEntries endpoint that checks edit permiss CVE-2026-1196628.8Songloft 2.9.0 before 2.13.6 contains a hardcoded credentials vulnerability that allows adjacent network attackers to authenticate as admini