Executive Summary

This vulnerability affects Movary, a self-hosted web app for tracking and rating watched movies. Before version 0.71.1, any authenticated user could access user-management endpoints such as `/settings/users` without proper admin-only restrictions. Due to missing admin middleware and a flawed authorization check in the controller, ordinary users could enumerate all users and create new administrator accounts. Essentially, users with a valid session could perform actions that should be limited to administrators.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts because it allows any authenticated user to escalate their privileges to administrator level. This means an attacker could gain full control over the application, including managing users and potentially accessing or modifying sensitive data. The CVSS score of 8.8 indicates high severity, with impacts on confidentiality, integrity, and availability.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Movary to version 0.71.1 or later, as this version patches the issue by enforcing proper admin-only middleware and fixing the broken authorization check.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows any authenticated user to enumerate all users and create a new administrator account due to improper access controls in Movary versions prior to 0.71.1.

Such unauthorized access and privilege escalation can lead to unauthorized disclosure, modification, or deletion of sensitive user data.

Consequently, this could result in non-compliance with data protection regulations like GDPR and HIPAA, which require strict access controls and protection of personal and sensitive information.

Useful 0 Not Useful 0