CVE-2026-119652 | HuLaSpark HuLa-Server up to 3.0.7 /user/friend/page FriendController.friendList uid authorization

October 30, 2026 Yanac

A vulnerability was found in HuLaSpark HuLa-Server up to 3.0.7. It has been classified as problematic. Affected by this issue is the function FriendController.friendList of the file /user/friend/page. This manipulation of the argument uid causes authorization bypass.

This vulnerability appears as CVE-2026-119652. The attack may be initiated remotely. There is no available exploit.VulDB Recent EntriesRead More