HuLa-Server through version 3.0.7 has an insecure direct object reference in FriendController.friendList that permits any authenticated user to supply a uid parameter and view another user's friend list. The lack of an administrator or owner check means the endpoint does not restrict access to the requesting user’s own contacts. Consequently, attackers can expose private contact data and use it for social engineering or other privacy‑violating attacks.

An affected system is HuLaSpark’s HuLa‑Server, released up to and including version 3.0.7. Users running any of these builds are susceptible.

The CVSS score of 5.3 indicates a moderately impactful vulnerability; however, the EPSS score is unavailable and it is not listed in the CISA KEV catalog, which suggests limited publicly known exploitation data. The attack requires authentication but no higher privileges, so any legitimate user can exploit it by crafting a GET request to /user/friend/page with a target uid. Because the flaw resides in a publicly accessible endpoint, the likelihood of exploitation is significant among authenticated users.