Threats tagged 'ghsa-6xjw-67p8-hqr9'

HuLa-Server versions through 3.0.7 have an insecure direct object reference (IDOR) vulnerability in the FeedController.delFeed function. Authenticated users can exploit this flaw by sending POST requests with arbitrary feedId values to delete other users' moments, including associated media, comments, and likes. This vulnerability allows unauthorized deletion of content without proper access control checks.