HuLa-Server CVE-2026-119652

Requires a valid authenticated HuLa-Server account (CVSS PR:L); the input shows no further special configuration or deployment mode. The concrete trigger, per the description and vendor source reference, is a GET request to /user/friend/page supplying another user's uid, which bypasses the missing administrator/owner check in FriendController.friendList. Limiting factors: exploitation is bounded to read-only disclosure of friend/contact lists (no write, no account takeover), needs network reachability to the server, and requires the attacker to hold or obtain a logged-in session plus knowledge or enumeration of victim uids. Affected versions are HuLa-Server through 3.0.7.

This is a moderate-severity information-disclosure issue (IDOR / CWE-639), not a high-urgency emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) shows network-reachable, low-complexity access requiring an authenticated account (PR:L), with only low confidentiality impact (VC:L) and no integrity or availability impact. The vuln.today decision label is 'this_month' - a routine patch priority rather than act_now/emergency. The flaw is NOT in CISA KEV, so there is no confirmed active exploitation. No EPSS score was supplied, so exploitation probability cannot be quantified from this data. A public technical write-up exists (hackmd) alongside the reporting VulnCheck advisory and the upstream GitHub issue, which lowers the practical barrier to reproduction. Signals are internally consistent: a real but bounded issue - any logged-in user can enumerate other users' friend/contact lists by changing a uid parameter, a privacy exposure rather than a system-compromise vector. The main caveat is that EPSS is missing and exploitation status beyond the write-up is not independently confirmed.

An attacker registers or already holds a valid low-privilege account on a HuLa-Server instance (≤3.0.7), then sends a GET request to /user/friend/page while substituting a victim's uid. Because the administrator/owner authorization check is missing, the server returns the victim's friend list, letting the attacker harvest social-graph/contact data for arbitrary users by iterating uids. A public PoC reference (hackmd write-up) describes the technique; it is not verified as working exploit code.