Threats affecting pkg:github/hulaspark/HuLa-Server

HuLa-Server versions through 3.0.7 have an insecure direct object reference (IDOR) vulnerability in the PrivacyController. Authenticated users can exploit this flaw by supplying another user's uid in GET or POST requests to the /privacy endpoint, allowing them to read and overwrite that user's privacy settings without proper ownership verification.

HuLa-Server versions up to 3.0.7 have an insecure direct object reference (IDOR) vulnerability in the FriendController.friendList endpoint. Authenticated users can exploit this flaw by supplying a uid parameter in GET requests to /user/friend/page, allowing them to view other users' friend lists without proper authorization checks. This vulnerability exposes user contact lists to unauthorized access.

HuLa-Server versions through 3.0.7 have an insecure direct object reference (IDOR) vulnerability in the FeedController.delFeed function. Authenticated users can exploit this flaw by sending POST requests with arbitrary feedId values to delete other users' moments, including associated media, comments, and likes. This vulnerability allows unauthorized deletion of content without proper access control checks.