CVE-2026-40350

Katalog CVE

CVSS 8.8 · High EPSS 0,59%

Kerentanan Incorrect Authorization pada leepeuker movary. Skor CVSS 3.1 8.8 (High) menurut github.com.

Deskripsi (NVD)

Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenticated user can access the user-management endpoints `/settings/users` and use them to enumerate all users and create a new administrator account. This happens because the route definitions do not enforce admin-only middleware, and the controller-level authorization check uses a broken boolean condition. As a result, any user with a valid web session cookie can reach functionality that should be restricted to administrators. Version 0.71.1 patches the issue.

Rincian

Terbit di NVD

18 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

0,59% peluang dieksploitasi; lebih tinggi dari 46,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/leepeuker/movary/security/advisories/GHSA-7r3f-9fwv-p43w exploit · advisory vendor
• https://github.com/leepeuker/movary/commit/92c7400486f5fe9f350046e04e45a8502778bf39 patch
• https://github.com/leepeuker/movary/pull/749 issue tracking · patch
• https://github.com/leepeuker/movary/releases/tag/0.71.1 release notes