CVE-2026-40349 PUBLISHED

Authenticated Movary User Can Self-Escalate to Administrator via PUT /settings/users/{userId} by Setting isAdmin=true

Assigner: GitHub_M
Reserved: 10.04.2026 Published: 18.04.2026 Updated: 18.04.2026

Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenticated user can escalate their own account to administrator by sending isAdmin=true to PUT /settings/users/{userId} for their own user ID. The endpoint is intended to let a user edit their own profile, but it updates the sensitive isAdmin field without any admin-only authorization check. Version 0.71.1 patches the issue.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 8.8

Product Status

Vendor leepeuker
Product movary
Versions
  • Version < 0.71.1 is affected

References

Problem Types

  • CWE-862: Missing Authorization CWE