Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenticated user can escalate their own account to administrator by sending `isAdmin=true` to `PUT /settings/users/{userId}` for their own user ID. The endpoint is intended to let a user edit their own profile, but it updates the sensitive `isAdmin` field without any admin-only authorization check. Version 0.71.1 patches the issue.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-40349 Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenticated user can escalate their own account to a… https://www.cve.org/CVERecord?id=CVE-2026-40349
Post summary
The post reports a privilege‑escalation flaw in Movary before version 0.71.1, providing basic technical details but no PoC, exploit, or patch information.
CVE-2026-40349 Privilege Escalation in Movary Prior to Version 0.71.1 via Admin Field Manipulation https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-40349
Post summary
CVE-2026-40349 is a disclosed privilege escalation vulnerability in Movary (pre‑0.71.1) that attackers can exploit by manipulating the admin field.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | leepeuker | movary | - | - | - |