HuLa-Server EUVD-2026-114067

The attacker must hold a valid authenticated user account on the target HuLa-Server instance (CVSS PR:L); this is the primary limiting factor. The specific trigger is a POST request to the /feed/del endpoint handled by FeedController.delFeed, with the feedId parameter set to a feed owned by another user - the handler acts on the supplied feedId without verifying that the caller owns that feed. No special non-default configuration, no user interaction, and no elevated privileges are required beyond a standard account, so any logged-in user can exploit it against default deployments up to version 3.0.7. The attacker also needs to know or enumerate valid feedId values belonging to victims. Impact is limited to deletion of moments and their associated media, comments, and likes; there is no disclosure of confidential data.

This is a genuine but moderate-priority issue, not a top-tier emergency. The CVSS 4.0 score of 5.3 (medium) reflects the balance: network vector (AV:N) and low complexity (AC:L) make it easy to trigger, but it requires authentication (PR:L) and no user interaction (UI:N), and impact is confined to integrity and availability of feed data (VI:L/VA:L) with no confidentiality loss (VC:N) and no scope change. The vuln.today decision label is 'this_month' rather than 'act_now' or 'emergency', consistent with a bounded, authorization-only data-destruction flaw. No EPSS score was provided, so exploitation probability cannot be quantified, and there is no CISA KEV listing, so there is no confirmed active exploitation. A public PoC reference exists (a hackmd write-up and a VulnCheck advisory describing the IDOR), so the technique is documented, but the input does not confirm working weaponized exploit code. The signals are internally consistent - a low-privilege authenticated attacker can destroy other users' data - so the main caveat is the missing EPSS value and the fact that risk is gated by the attacker already holding a valid account on the instance.

An attacker registers or already holds a normal authenticated account on a HuLa-Server instance (≤3.0.7), then sends a POST request to /feed/del supplying another user's feedId instead of their own. Because FeedController.delFeed does not verify ownership of the referenced feed, the victim's moment is deleted along with its associated media, comments, and likes. A public PoC reference exists describing this flow; it is not verified as working exploit code.