CVE-2026-40349
High
Description
Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenticated user can escalate their own account to administrator by sending `isAdmin=true` to `PUT /settings/users/{userId}` for their own user ID. The endpoint is intended to let a user edit their own profile, but it updates the sensitive `isAdmin` field without any admin-only authorization check. Version 0.71.1 patches the issue.
SeverityHigh
CVSS8.8
Exploit probability—
ProductLeepeuker Movary
PublishedApr 18, 2026
First seenApr 18, 2026
Weakness typeCWE-862Missing authorization
How to fix
Update
- leepeuker movary0.71.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| leepeuker movary | v < 0.71.1 | 0.71.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.