CVE-2026-40350

HighCVSS 8.8/10Last modified Oct 26, 2026

Description

Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenticated user can access the user-management endpoints `/settings/users` and use them to enumerate all users and create a new administrator account. This happens because the route definitions do not enforce admin-only middleware, and the controller-level authorization check uses a broken boolean condition. As a result, any user with a valid web session cookie can reach functionality that should be restricted to administrators. Version 0.71.1 patches the issue.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
leepeuker	movary	< 0.71.1

References

https://github.com/leepeuker/movary/commit/92c7400486f5fe9f350046e04e45a8502778bf39Patch
https://github.com/leepeuker/movary/pull/749Issue Tracking, Patch
https://github.com/leepeuker/movary/releases/tag/0.71.1Release Notes
https://github.com/leepeuker/movary/security/advisories/GHSA-7r3f-9fwv-p43wExploit, Vendor Advisory

Timeline

Published: Apr 18, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-403519.8FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the password-based login endpoint uses TypeScript type assertion wi CVE-2026-403528.8FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the password change endpoint is vulnerable to NoSQL injection. An a CVE-2026-403535.4wger is a free, open-source workout and fitness manager. In versions 2.5 and below, the attribution_link property in AbstractLicenseModel co CVE-2026-403546.3Flatpak xdg-desktop-portal before 1.20.4 and 1.21.x before 1.21.1 allows any Flatpak app to trash any file in the host context via a symlink CVE-2026-403557.5In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system CVE-2026-403567.5In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accep CVE-2026-403578.8Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2026-403588.4Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2026-403597.8Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2026-40366.5An improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Sharing API in Synology DiskStation CVE-2026-403607.8Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.CVE-2026-403618.4Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.