Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenticated user can access the user-management endpoints `/settings/users` and use them to enumerate all users and create a new administrator account. This happens because the route definitions do not enforce admin-only middleware, and the controller-level authorization check uses a broken boolean condition. As a result, any user with a valid web session cookie can reach functionality that should be restricted to administrators. Version 0.71.1 patches the issue.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-40350 Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenticated user can access the user-management endp… https://www.cve.org/CVERecord?id=CVE-2026-40350
Post summary
CVE‑2026‑40350 is a vulnerability in Movary prior to version 0.71.1 that allows authenticated users to access the user‑management endpoint; the issue is mitigated in version 0.71.1.
CVE-2026-40350 Unauthorized Administrator Account Creation in Movary Before 0.71.1 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-40350
Post summary
The post announces CVE-2026-40350, a flaw allowing unauthorized admin account creation in Movary versions prior to 0.71.1. No exploit code, patch, or active usage is mentioned.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | leepeuker | movary | - | - | - |