# CVE-2026-119651: HuLa-Server insecure direct object reference in FeedController.delFeed

Source: https://junglewise.ai/threats/cve-2026-119651-hula-server-through-3-0-7-contains-an-insecure-direct-object  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-119651 · Severity: medium · CVSS 5.4 · Published 2026-10-30

HuLa-Server is an instant messaging service that allows users to share moments (posts) with associated media, comments, and likes. An authenticated attacker can delete other users' moments and their related content by exploiting improper access controls in the feed deletion function. This allows any logged-in user to destroy another user's posts and engagement without authorization.

Technologies: [HuLaSpark HuLa-Server](https://junglewise.ai/threats/technologies/hula-server). Vendors: [HuLaSpark](https://junglewise.ai/threats/vendors/hulaspark).

## Quick answers

**Is CVE-2026-119651 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-119651 being exploited in the wild.

**How severe is CVE-2026-119651?** Medium severity, with a CVSS score of 5.4, published 30 October 2026.

**Which products and versions are affected?** HuLaSpark HuLa-Server through 3.0.7.

**Is there a fix for CVE-2026-119651?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-119651 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-119651?** Check whether you run HuLaSpark HuLa-Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The FeedController.delFeed endpoint contains an insecure direct object reference (IDOR) vulnerability where it fails to validate that the authenticated user owns the feed being deleted. An attacker can craft POST requests to /feed/del with arbitrary feedId values belonging to other users, bypassing authorization checks. This results in unauthorized deletion of feeds, media, comments, and associated engagement data.

## Affected products

- HuLaSpark HuLa-Server through 3.0.7

## Timeline

- 2026-10-30: disclosed

## References

- [https://github.com/HuLaSpark/HuLa-Server](https://github.com/HuLaSpark/HuLa-Server)
- [https://github.com/HuLaSpark/HuLa-Server/blob/v3.0.7/luohuo-cloud/luohuo-im/luohuo-im-biz/src/main/java/com/luohuo/flex/im/core/user/service/impl/FeedServiceImpl.java](https://github.com/HuLaSpark/HuLa-Server/blob/v3.0.7/luohuo-cloud/luohuo-im/luohuo-im-biz/src/main/java/com/luohuo/flex/im/core/user/service/impl/FeedServiceImpl.java)

## Related threats

- [HuLa-Server insecure direct object reference in friend list](https://junglewise.ai/threats/cve-2026-119652-hula-server-through-3-0-7-contains-an-insecure-direct-object)
- [HuLa-Server insecure direct object reference in PrivacyController](https://junglewise.ai/threats/cve-2026-119650-hula-server-through-3-0-7-contains-an-insecure-direct-object)