Description
Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenticated user can access the user-management endpoints `/settings/users` and use them to enumerate all users and create a new administrator account. This happens because the route definitions do not enforce admin-only middleware, and the controller-level authorization check uses a broken boolean condition. As a result, any user with a valid web session cookie can reach functionality that should be restricted to administrators. Version 0.71.1 patches the issue.
INFO
Published Date :
2026-04-18T00:07:33.324Z
Last Modified :
2026-04-18T00:07:33.324Z
Source :
GitHub_M
AFFECTED PRODUCTS
The following products are affected by CVE-2026-40350 vulnerability.
| Vendors | Products |
|---|---|
| Leepeuker |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2026-40350.
