Movary Admin Escalation: A Simple Patch, A Critical Flaw

The National Vulnerability Database has detailed CVE-2026-40349, a high-severity vulnerability affecting Movary, a self-hosted movie tracking web application. Prior to version 0.71.1, an authenticated user could escalate their privileges to administrator by manipulating a PUT request to their own user settings. Specifically, sending isAdmin=true to the /settings/users/{userId} endpoint for their own user ID would bypass authorization checks, granting administrative access.

This flaw, rated 8.8 CVSS (HIGH) and categorized as CWE-862 (Missing Authorization), highlights a common developer oversight: trusting client-side input for sensitive operations. The endpoint, intended for profile edits, failed to validate if the isAdmin field modification was authorized for a non-admin user. Version 0.71.1 addresses this critical issue.

For defenders, this is a textbook example of why granular access control and server-side validation are non-negotiable. An attacker’s calculus here is simple: find an authenticated endpoint that updates user attributes and see which sensitive fields can be tampered with. This often provides a quick path to full system compromise from a low-privilege foothold.