Is CVE-2026-119652 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-119652?

CVE-2026-119652 has a CVSS v3 severity of MEDIUM (4.3).

Back

CVE-2026-119652

Description

HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FriendController.friendList that allows authenticated users to view other users' friend lists by supplying a uid parameter. Attackers can send GET requests to /user/friend/page with a victim's uid, bypassing the missing administrator or owner check to read any user's contact list.