Is CVE-2026-119652 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-119652 being exploited in the wild.

How severe is CVE-2026-119652?

Medium severity, with a CVSS score of 4.3, published 30 October 2026.

Which products and versions are affected?

HuLaSpark HuLa-Server through 3.0.7.

Is there a fix for CVE-2026-119652?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-119652 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-119652?

Check whether you run HuLaSpark HuLa-Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-119652: HuLa-Server insecure direct object reference in friend list

CVE-2026-119652 · Severity: medium · CVSS 4.3 · Published 2026-10-30

HuLa-Server is an instant messaging platform that manages user contacts and communications. An authenticated attacker can view any other user's friend list by manipulating a user ID parameter, bypassing access controls that should restrict users to their own contacts only. This allows unauthorized disclosure of users' social networks and contact information.

Technologies: HuLaSpark HuLa-Server. Vendors: HuLaSpark.

Quick answers

Is CVE-2026-119652 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-119652 being exploited in the wild.
How severe is CVE-2026-119652?: Medium severity, with a CVSS score of 4.3, published 30 October 2026.
Which products and versions are affected?: HuLaSpark HuLa-Server through 3.0.7.
Is there a fix for CVE-2026-119652?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-119652 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-119652?: Check whether you run HuLaSpark HuLa-Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The FriendController.friendList endpoint in HuLa-Server through 3.0.7 accepts an optional uid parameter that specifies which user's friend list to retrieve. The application fails to validate that the requesting user is an administrator or the owner of the target uid, allowing any authenticated user to retrieve arbitrary users' friend lists by sending a GET request to /user/friend/page with a victim's uid. The vulnerability is an insecure direct object reference (IDOR) that requires prior authentication.

Affected products

HuLaSpark HuLa-Server through 3.0.7

Timeline

2026-10-30: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.