Threats affecting pkg:github/HuLa-Server

HuLa-Server versions up to 3.0.7 have an insecure direct object reference vulnerability in the FriendController.friendList endpoint. Authenticated users can bypass authorization checks by supplying a user ID (uid) parameter in GET requests to /user/friend/page, allowing them to view other users' friend lists without proper permission.

HuLa-Server versions up to 3.0.7 have an authorization bypass vulnerability in the FeedController.delFeed function. Authenticated users can delete moments belonging to other users by providing arbitrary feedId values in POST requests to /feed/del. This allows attackers to remove other users' moments, including associated media, comments, and likes.

HuLa-Server versions up to 3.0.7 have an insecure direct object reference vulnerability in the PrivacyController. Authenticated users can exploit this flaw by supplying another user's uid in GET or POST requests to the /privacy endpoint, allowing them to read and modify that user's privacy settings without proper authorization checks.