CVE-2026-40349HIGH 8.8EPSS p40.5%

CVE-2026-40349CVE-2026-40349

Description

Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenticated user can escalate their own account to administrator by sending `isAdmin=true` to `PUT /settings/users/{userId}` for their own user ID. The endpoint is intended to let a user edit their own profile, but it updates the sensitive `isAdmin` field without any admin-only authorization check. Version 0.71.1 patches the issue.

Scoring

CVSS 3.18.8 (HIGH)
VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS0.53% probability of exploitation · percentile 40.5% · 2026-06-19T12:03:05Z
Published2026-04-18
Last modified2026-04-27

Underlying weaknesses· 1

CWE-862

References

  1. https://github.com/leepeuker/movary/commit/12c8a090051b1a1c07a3aa48922f3bc9ffe44c8b
  2. https://github.com/leepeuker/movary/pull/750
  3. https://github.com/leepeuker/movary/releases/tag/0.71.1
  4. https://github.com/leepeuker/movary/security/advisories/GHSA-mcfq-8rx7-w25v

1

TypeTargetConfidenceTier
WeaknessMissing Authorizationcwe-8620%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2026-40350
CVE
CVE-2026-30269
CVE
CVE-2026-34427
CVE
CVE-2026-42562
CVE
CVE-2026-38529
CVE
CVE-2025-50433
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.