The vulnerability is an Insecure Direct Object Reference in the /privacy endpoint of HuLa-Server. An authenticated user can supply any uid as a parameter and the server will return that user’s privacy settings or allow them to overwrite them, bypassing any ownership checks. This enables an attacker to read or alter another user’s privacy configuration, potentially affecting the confidentiality and integrity of personal data.

HuLaSpark’s HuLa‑Server, versions 3.0.7 and earlier, includes the flaw exposed in the PrivacyController component. The affected releases are identified by the CNA as all releases up to and including 3.0.7. Users running these versions on any environment that exposes the /privacy endpoint are impacted.

The vulnerability has a CVSS score of 5.3, indicating moderate severity. The EPSS score is not available, so the current exploit probability remains uncertain. The flaw is not listed in the CISA KEV catalog. The attack vector is authenticated access, meaning an attacker must first authenticate to the system or obtain credentials for a user. Once authenticated, the attacker can simply send a crafted GET or POST request to /privacy with a target uid value, and the server will return or replace that user’s privacy settings without further validation.