Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenticated user can access the user-management endpoints `/settings/users` and use them to enumerate all users and create a new administrator account. This happens because the route definitions do not enforce admin-only middleware, and the controller-level authorization check uses a broken boolean condition. As a result, any user with a valid web session cookie can reach functionality that should be restricted to administrators. Version 0.71.1 patches the issue.
References
| Link | Resource |
|---|---|
| https://github.com/leepeuker/movary/commit/92c7400486f5fe9f350046e04e45a8502778bf39 | Patch |
| https://github.com/leepeuker/movary/pull/749 | Issue Tracking Patch |
| https://github.com/leepeuker/movary/releases/tag/0.71.1 | Release Notes |
| https://github.com/leepeuker/movary/security/advisories/GHSA-7r3f-9fwv-p43w | Exploit Vendor Advisory |
Configurations
History
27 Apr 2026, 14:09
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Leepeuker
Leepeuker movary |
|
| CPE | cpe:2.3:a:leepeuker:movary:*:*:*:*:*:*:*:* | |
| References | () https://github.com/leepeuker/movary/commit/92c7400486f5fe9f350046e04e45a8502778bf39 - Patch | |
| References | () https://github.com/leepeuker/movary/pull/749 - Issue Tracking, Patch | |
| References | () https://github.com/leepeuker/movary/releases/tag/0.71.1 - Release Notes | |
| References | () https://github.com/leepeuker/movary/security/advisories/GHSA-7r3f-9fwv-p43w - Exploit, Vendor Advisory |
18 Apr 2026, 01:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-18 01:16
Updated : 2026-04-27 14:09
NVD link : CVE-2026-40350
Mitre link : CVE-2026-40350
CVE.ORG link : CVE-2026-40350
JSON object : View
Products Affected
leepeuker
- movary
CWE
CWE-863
Incorrect Authorization