Threats tagged 'ghsa-93wv-ghwm-f3xh'

1 threat

Severity	CVSS	Threat	Source	Published	Score and star
Medium	5.3	CVE-2026-119652HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FriendController.friendList Medium5.32026-10-30GCVE DatabaseCVE-2026-119652 HuLa-Server versions up to 3.0.7 have an insecure direct object reference (IDOR) vulnerability in the FriendController.friendList endpoint. Authenticated users can exploit this flaw by supplying a uid parameter in GET requests to /user/friend/page, allowing them to view other users' friend lists without proper authorization checks. This vulnerability exposes user contact lists to unauthorized access. Report on CVE-2026-119652 Vulnerability CWE-639 #ghsa-93wv-ghwm-f3xh	GCVE Database	2026-10-30

Page 1 of 1