CVE-2026-40350
Authorization Bypass in Movary Allows Privilege Escalation
Publication date: 2026-04-18
Last updated on: 2026-04-27
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| leepeuker | movary | to 0.71.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects Movary, a self-hosted web app for tracking and rating watched movies. Before version 0.71.1, any authenticated user could access user-management endpoints such as `/settings/users` without proper admin-only restrictions. Due to missing admin middleware and a flawed authorization check in the controller, ordinary users could enumerate all users and create new administrator accounts. Essentially, users with a valid session could perform actions that should be limited to administrators.
How can this vulnerability impact me? :
This vulnerability can have severe impacts because it allows any authenticated user to escalate their privileges to administrator level. This means an attacker could gain full control over the application, including managing users and potentially accessing or modifying sensitive data. The CVSS score of 8.8 indicates high severity, with impacts on confidentiality, integrity, and availability.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade Movary to version 0.71.1 or later, as this version patches the issue by enforcing proper admin-only middleware and fixing the broken authorization check.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows any authenticated user to enumerate all users and create a new administrator account due to improper access controls in Movary versions prior to 0.71.1.
Such unauthorized access and privilege escalation can lead to unauthorized disclosure, modification, or deletion of sensitive user data.
Consequently, this could result in non-compliance with data protection regulations like GDPR and HIPAA, which require strict access controls and protection of personal and sensitive information.