HuLa-Server up to version 3.0.7 contains an insecure direct object reference in the FeedController.delFeed endpoint. The flaw allows any authenticated user to supply an arbitrary feedId and delete another user's moments, along with related media, comments, and likes. This results in loss of user content and can erode trust, though it does not expose other data. The weakness is a classic IDOR (CWE‑639).

Vulnerable products are HuLaSpark's HuLa-Server software running any version up through 3.0.7. The issue resides in the feed deletion feature implemented in FeedController. No other vendor or product versions are listed as affected.

The CVSS score of 5.3 classifies the problem as medium severity. Because the flaw requires user authentication, exploitation typically occurs after attackers gain or impersonate valid credentials. The EPSS is unavailable, and the issue is not listed in CISA’s KEV catalogue, indicating no confirmed public exploits. However, the vulnerability is easily triggered by sending a crafted POST request to /feed/del with a targeted feedId, making it a low‑effort, high‑impact attack in environments where user credentials are compromised.