EUVD-2026-45434
GHSA-hx75-7v3c-c53c
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable API but requires valid low-privilege session (PR:L); disclosure limited to read-only operational telemetry with no integrity or availability impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was identified in jxxghp MoviePilot up to 2.13.5. The affected element is an unknown function of the file /jxxghp/MoviePilot of the component Application API. The manipulation leads to improper authorization. Remote exploitation of the attack is possible. The identifier of the patch is dc2b6910a423b3bfadeffaa303e1ba75cfb33900. Applying a patch is the recommended action to fix this issue.
AnalysisAI
Improper authorization across multiple dashboard API endpoints in MoviePilot through version 2.13.5 allows any authenticated low-privilege user to access administrative telemetry that should be restricted to superusers. The root cause, confirmed by patch commit dc2b6910a423b3bfadeffaa303e1ba75cfb33900, is that route handlers in app/api/endpoints/dashboard.py used verify_token (any valid session) rather than get_current_active_superuser for endpoints exposing system stats, storage, CPU/memory usage, downloader metrics, and scheduler information. No public exploit has been identified and this CVE is not listed in the CISA KEV catalog.
Technical ContextAI
MoviePilot is a self-hosted media automation platform built on FastAPI, analogous to Sonarr/Radarr, primarily targeting Chinese-language deployments. FastAPI uses dependency injection via Depends() to enforce authorization on route handlers. The vulnerability (CWE-285, Improper Authorization) arises because multiple dashboard routes - /statistic, /storage, /processes, /downloader, /schedule, /transfer, /cpu, and /memory - declared their authorization dependency as verify_token, which validates any legitimate JWT/session token regardless of user role, rather than get_current_active_superuser, which additionally enforces the superuser flag. The system correctly authenticates the caller but fails to check whether that caller's role permits access to privileged resources. The fix refactors common logic into private helper functions (_build_statistic, _build_storage, _build_downloader) and rewires all privileged routes to get_current_active_superuser, while retaining the separate API-token-authenticated variants (statistic2, storage2, etc.) for programmatic access. CPE cpe:2.3:a:jxxghp:moviepilot:*:*:*:*:*:*:*:* covers all versions through 2.13.5.
RemediationAI
The upstream fix is available as commit dc2b6910a423b3bfadeffaa303e1ba75cfb33900 at https://github.com/jxxghp/MoviePilot/commit/dc2b6910a423b3bfadeffaa303e1ba75cfb33900. Users should update MoviePilot to the latest release from https://github.com/jxxghp/MoviePilot/ that incorporates this commit; a specific tagged release version was not confirmed from available data, so check the GitHub Releases page to identify the first release after this commit. As a compensating control prior to patching, restrict MoviePilot instance access to trusted users only - avoid creating non-superuser accounts on internet-facing deployments, or place the instance behind a VPN or IP allowlist to prevent exploitation by low-trust account holders. Note that restricting network access does not remediate the flaw if untrusted users already hold valid credentials.
More in Moviepilot
View allPath traversal in MoviePilot's AliPan, U115, Rclone, and SMB cloud storage download handlers allows an attacker who cont
Server-side request forgery in MoviePilot v2's image proxy endpoint (/api/v1/system/img-proxy) allows authenticated atta
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today