EUVD-2026-45434
GHSA-hx75-7v3c-c53c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege MoviePilot account
-
ExploitAuthenticate via API and retrieve session token
-
ExecutionIssue GET requests to /dashboard/* admin endpoints with standard token
-
ImpactReceive superuser-restricted system telemetry
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization verification
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires possession of a valid MoviePilot account with at least low-privilege (non-superuser) authentication. The attacker must have network access to the MoviePilot API endpoint. The vulnerability is present in all installations of MoviePilot through 2.13.5 that have any non-superuser accounts created; single-user deployments where the sole account is a superuser are effectively unexploitable. Impact is strictly read-only: the exposed endpoints return operational telemetry (storage stats, CPU/memory metrics, downloader speeds, media counts, scheduler state) and do not permit data modification or deletion. Exploitation is impossible without credentials - unauthenticated requests are rejected by |
| Impact | The CVSS 4.0 score of 5.3 (Medium) accurately reflects a constrained real-world risk profile. The vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N confirms network-reachable exploitation with no attack complexity, but critically requires a valid low-privilege account (PR:L) - unauthenticated exploitation is not possible. The confidentiality impact is rated Low (VC:L), confined to operational telemetry such as download speeds, storage free space, CPU percentages, and media counts - not credentials, user data, or secrets. There is no integrity or availability impact from the exposed endpoints. No EPSS score was provided; without it, exploitation probability cannot be quantified. The absence of a CISA KEV listing and no identified public exploit code further reduces urgency. Risk is most relevant in multi-tenant MoviePilot deployments where accounts are issued to users with varying trust levels. Single-user or family-server deployments where all users are already trusted face negligible practical risk. |
| Exploit ScenarioDerived | An attacker with a standard (non-superuser) MoviePilot account authenticates to the API and obtains a valid session token. They then issue HTTP GET requests to admin dashboard endpoints such as |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 19, 2026
Improper authorization across multiple dashboard API endpoints in MoviePilot through version 2.13.5 allows any authenticated low-privilege user to access administrative telemetry that should be restricted to superusers. The root cause, confirmed by patch commit dc2b6910a423b3bfadeffaa303e1ba75cfb33900, is that route handlers in app/api/endpoints/dashboard.py used verify_token (any valid session) rather than get_current_active_superuser for endpoints exposing system stats, storage, CPU/memory usage, downloader metrics, and scheduler information. No public exploit has been identified and this CVE is not listed in the CISA KEV catalog.
RemediationAI
The upstream fix is available as commit dc2b6910a423b3bfadeffaa303e1ba75cfb33900 at https://github.com/jxxghp/MoviePilot/commit/dc2b6910a423b3bfadeffaa303e1ba75cfb33900. Users should update MoviePilot to the latest release from https://github.com/jxxghp/MoviePilot/ that incorporates this commit; a specific tagged release version was not confirmed from available data, so check the GitHub Releases page to identify the first release after this commit. As a compensating control prior to patching, restrict MoviePilot instance access to trusted users only - avoid creating non-superuser accounts on internet-facing deployments, or place the instance behind a VPN or IP allowlist to prevent exploitation by low-trust account holders. Note that restricting network access does not remediate the flaw if untrusted users already hold valid credentials.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
MoviePilot is a self-hosted media automation platform built on FastAPI, analogous to Sonarr/Radarr, primarily targeting Chinese-language deployments. FastAPI uses dependency injection via Depends() to enforce authorization on route handlers. The vulnerability (CWE-285, Improper Authorization) arises because multiple dashboard routes - /statistic, /storage, /processes, /downloader, /schedule, /transfer, /cpu, and /memory - declared their authorization dependency as verify_token, which validates any legitimate JWT/session token regardless of user role, rather than get_current_active_superuser, which additionally enforces the superuser flag. The system correctly authenticates the caller but fails to check whether that caller's role permits access to privileged resources. The fix refactors common logic into private helper functions (_build_statistic, _build_storage, _build_downloader) and rewires all privileged routes to get_current_active_superuser, while retaining the separate API-token-authenticated variants (statistic2, storage2, etc.) for programmatic access. CPE cpe:2.3:a:jxxghp:moviepilot:*:*:*:*:*:*:*:* covers all versions through 2.13.5.
Know when Moviepilot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Network-reachable API but requires valid low-privilege session (PR:L); disclosure limited to read-only operational telemetry with no integrity or availability impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
DescriptionCVE.org
A vulnerability was identified in jxxghp MoviePilot up to 2.13.5. The affected element is an unknown function of the file /jxxghp/MoviePilot of the component Application API. The manipulation leads to improper authorization. Remote exploitation of the attack is possible. The identifier of the patch is dc2b6910a423b3bfadeffaa303e1ba75cfb33900. Applying a patch is the recommended action to fix this issue.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Moviepilot
View allArbitrary OS command execution on hosts running MoviePilot through 3.1.5 is achievable when the product's LLM agent inge
Path traversal in MoviePilot's AliPan, U115, Rclone, and SMB cloud storage download handlers allows an attacker who cont
Server-side request forgery in MoviePilot v2's image proxy endpoint (/api/v1/system/img-proxy) allows authenticated atta
MoviePilot through 3.1.2 deserializes untrusted Python pickle data when restoring saved workflow execution context, and
Exploit-DB