CVE-2026-40350 Missing authorization in movary
Low-privileged users can bypass authorization to enumerate all users and create administrator accounts in Movary.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-40350?
CVE-2026-40350 is a high-severity missing authorization vulnerability in leepeuker movary, published on 18 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenticated user can access the user-management endpoints `/settings/users` and use them to enumerate all users and create a new administrator account. This happens because the route definitions do not enforce admin-only middleware, and the controller-level authorization check uses a broken boolean condition. As a result, any user with a valid web session cookie can reach functionality that should be restricted to administrators. Version 0.71.1 patches the issue.
Weakness: CWE-863
Which versions are affected by CVE-2026-40350?
It affects 1 product.
Products include Leepeuker Movary.
How do I fix CVE-2026-40350?
No fix has been published for CVE-2026-40350 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-40350 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-40350 exists.
Other vulnerabilities in leepeuker movary
- CVE-2026-23839 Movary vulnerable to Cross-site Scripting with `?categoryUpdated=` param
- CVE-2026-23840 Movary vulnerable to Cross-site Scripting with `?categoryDeleted=` param
- CVE-2026-23841 Movary vulnerable to Cross-site Scripting with `?categoryCreated=` param
- CVE-2026-40349 Authenticated Movary User Can Self-Escalate to Administrator via PUT /settings/users/{userId} by Setting isAdmin=true
- CVE-2026-40348 Movary has Authenticated SSRF via Jellyfin Server URL Verification that Allows Internal Network Probing
Sources
Also known as GHSA-7r3f-9fwv-p43w.