CVE-2026-40350 Details

A privilege escalation vulnerability has been identified in Movary, a self-hosted web application for tracking and rating movies. In versions prior to 0.71.1, authenticated users could access user-management endpoints '/settings/users' without proper authorization. This allowed them to enumerate all users and create new administrator accounts. The issue arose because the route definitions lacked admin-only middleware, and the authorization check at the controller level was flawed, enabling any user with a valid session cookie to access functionalities meant for administrators.

Users can update to Movary version 0.71.1 or later, where this vulnerability has been patched.