Movary SSRF: Authenticated Users Can Probe Internal Networks

The National Vulnerability Database has detailed CVE-2026-40348, a high-severity Server-Side Request Forgery (SSRF) vulnerability in Movary, a self-hosted movie tracking web application. Prior to version 0.71.1, an authenticated user could exploit the /settings/jellyfin/server-url-verify endpoint to trigger server-side HTTP requests to arbitrary internal targets. The endpoint, designed to verify a Jellyfin server URL, appends /system/info/public to a user-controlled URL and sends a request via Guzzle.

Critically, the National Vulnerability Database highlights that Movary lacked restrictions on internal hosts, loopback addresses, or private network ranges. This oversight allows an ordinary authenticated user to perform internal network reconnaissance, including host discovery, port-state probing, and service fingerprinting. For deployments with internal administrative services or cloud metadata endpoints, this vulnerability presents a direct pathway for attackers to reach otherwise inaccessible critical infrastructure.

This isn’t just about finding open ports; it’s about an attacker gaining a foothold to map your internal network topology and identify high-value targets. The CVSS score of 7.7 (HIGH) reflects the significant impact of unauthenticated access to internal network details. Defenders need to recognize that even ‘ordinary’ authenticated users can be compromised, and this vulnerability turns them into internal reconnaissance agents.