CVE-2026-40350

Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenticated user can access the user-management endpoints `/settings/users` and use them to enumerate all users and create a new administrator account. This happens because the route definitions do not enforce admin-only middleware, and the controller-level authorization check uses a broken boolean condition. As a result, any user with a valid web session cookie can reach functionality that should be restricted to administrators. Version 0.71.1 patches the issue.

• CWE-863

• https://github.com/leepeuker/movary/commit/92c7400486f5fe9f350046e04e45a8502778bf39Patch
• https://github.com/leepeuker/movary/pull/749Issue Tracking, Patch
• https://github.com/leepeuker/movary/releases/tag/0.71.1Release Notes
• https://github.com/leepeuker/movary/security/advisories/GHSA-7r3f-9fwv-p43wExploit, Vendor Advisory

Published

Apr 18, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-40344MinIO is a high-performance object storage system. Starting …8.2
• CVE-2026-40346NocoBase is an AI-powered no-code/low-code platform for buil…6.5
• CVE-2026-40347Python-Multipart is a streaming multipart parser for Python.…5.3
• CVE-2026-40348Movary is a self hosted web app to track and rate a user's w…7.7
• CVE-2026-40349Movary is a self hosted web app to track and rate a user's w…8.8
• CVE-2026-4035A vulnerability in mlflow/mlflow versions prior to 3.11.0 al…7.7
• CVE-2026-40351FastGPT is an AI Agent building platform. In versions prior …9.8
• CVE-2026-40352FastGPT is an AI Agent building platform. In versions prior …8.8
• CVE-2026-40353wger is a free, open-source workout and fitness manager. In …5.4
• CVE-2026-40354Flatpak xdg-desktop-portal before 1.20.4 and 1.21.x before 1…6.3
• CVE-2026-40355In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL …7.5
• CVE-2026-40356In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an inte…7.5