CVE-2026-40349
Movary is a self hosted web app to track and rate a user's watched movies.
Published Apr 18, 2026 · updated Jun 17, 2026 · leepeuker movary
Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenticated user can escalate their own account to administrator by sending to for their own user ID. The endpoint is intended to let a user edit their own profile, but it updates the sensitive field without any admin-only authorization check. Version 0.71.1 patches the issue.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Apr 18, 2026 · NIST NVD
Detected
Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenticated user can escalate their own account to administrator by sending to for their own user ID. The endpoint is intended to let a user edit their own profile, but it updates the sensitive field without any admin-only authorization check. Version 0.71.1 patches the issue.
Jun 17, 2026 · NIST NVD
Updated
Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenticated user can escalate their own account to administrator by sending to for their own user ID. The endpoint is intended to let a user edit their own profile, but it updates the sensitive field without any admin-only authorization check. Version 0.71.1 patches the issue.
Affected
- cpe leepeuker/movaryversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-40349
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-40349
Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenticated user can escalate their own account to administrator by sending to for their own user ID. The endpoint is in
nvd.nist.gov