Movary Flaw Allows Admin Account Creation, High-Severity Risk

The National Vulnerability Database has disclosed CVE-2026-40350, a high-severity vulnerability (CVSS 8.8) affecting Movary, a self-hosted web application for tracking movies. Prior to version 0.71.1, an authenticated user could exploit flaws in route definitions and controller-level authorization to enumerate all users and create a new administrator account. This bypasses intended access controls, granting full administrative privileges to an attacker with a valid web session.

The core issue, identified as CWE-863 (Improper Authorization), stems from Movary’s failure to enforce administrative-only middleware on critical user-management endpoints like /settings/users. Compounding this, the authorization check at the controller level utilized a broken boolean condition. This allowed any logged-in user to access functionality that should have been strictly restricted to administrators, demonstrating a critical failure in the application’s security architecture.

For defenders, this means a low-privilege user can escalate to full admin. The attacker’s calculus is simple: get any valid user session, then elevate. This isn’t a complex RCE, it’s a fundamental authorization breakdown. Movary version 0.71.1 patches this critical flaw, making immediate upgrades essential for anyone running the application.