CVE-2026-119652 HuLa-Server through 3.0.7 IDOR via /user/friend/page Friend List Disclosure
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-119652?
CVE-2026-119652 is a medium-severity vulnerability in HuLaSpark HuLa-Server, published on 30 Oct 2026.
Official description
HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FriendController.friendList that allows authenticated users to view other users' friend lists by supplying a uid parameter. Attackers can send GET requests to /user/friend/page with a victim's uid, bypassing the missing administrator or owner check to read any user's contact list.
Weakness: CWE-639
Which versions are affected by CVE-2026-119652?
How do I fix CVE-2026-119652?
No fix has been published for CVE-2026-119652 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-119652 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-119652 exists.
Sources
Also known as GHSA-93wv-ghwm-f3xh.