CVE-2026-40349: fallo de gravedad alta en leepeuker movary
Authenticated Movary User Can Self-Escalate to Administrator via PUT /settings/users/{userId} by Setting isAdmin=true
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.8epss 0.5%
Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenticated user can escalate their own account to administrator by sending `isAdmin=true` to `PUT /settings/users/{userId}` for their own user ID. The endpoint is intended to let a user edit their own profile, but it updates the sensitive `isAdmin` field without any admin-only authorization check. Version 0.71.1 patches the issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Productos afectados
leepeuker · movaryCVEs relacionadas — leepeuker movary
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-40350HIGHMovary User Management (/settings/users) has Authorization Bypass that Allows Low-Privileged Users to Enumerate All Users and Create Administrator AccountsEPSS 0.4%CVE-2026-40348HIGHMovary has Authenticated SSRF via Jellyfin Server URL Verification that Allows Internal Network ProbingEPSS 0.4%CVE-2026-23839CRITICALMovary vulnerable to Cross-site Scripting with `?categoryUpdated=` paramEPSS 0.3%CVE-2026-23840CRITICALMovary vulnerable to Cross-site Scripting with `?categoryDeleted=` paramEPSS 0.3%CVE-2026-23841CRITICALMovary vulnerable to Cross-site Scripting with `?categoryCreated=` paramEPSS 0.3%CVE-2025-64115MEDIUMMovary unvalidated Referer header allows open redirect and phishingEPSS 0.3%