EUVD-2026-23619Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
8DescriptionGitHub Advisory
Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenticated user can escalate their own account to administrator by sending isAdmin=true to PUT /settings/users/{userId} for their own user ID. The endpoint is intended to let a user edit their own profile, but it updates the sensitive isAdmin field without any admin-only authorization check. Version 0.71.1 patches the issue.
AnalysisAI
Authenticated users in Movary (self-hosted movie tracking web app) can escalate privileges to administrator via a missing authorization check in the user settings endpoint. By sending a crafted PUT request to /settings/users/{userId} with isAdmin=true for their own user ID, low-privilege users gain full administrative access. Movary versions prior to 0.71.1 are affected. Vendor-released patch version 0.71.1 available. EPSS data not provided; no CISA KEV listing identified. GitHub references include security advisory GHSA-mcfq-8rx7-w25v and fix commit 12c8a090.
Technical ContextAI
This is a classic Insecure Direct Object Reference (IDOR) combined with Missing Authorization vulnerability (CWE-862). The Movary application, a PHP/web-based movie tracking system, exposes a RESTful endpoint (PUT /settings/users/{userId}) designed for users to update their own profile data. The endpoint performs vertical privilege escalation by allowing users to modify the sensitive isAdmin boolean field without server-side validation that only existing administrators can grant admin rights. This violates the principle of least privilege enforcement-while the endpoint correctly authenticates the user (PR:L in CVSS), it fails to authorize whether that authenticated user has permission to change security-critical attributes. The affected product CPE is cpe:2.3:a:leepeuker:movary:*:*:*:*:*:*:*:* for all versions before 0.71.1. The vulnerability exists in the server-side authorization logic of the user management module, likely in the API route handler or model layer that processes PUT requests to user settings.
RemediationAI
Upgrade immediately to Movary version 0.71.1 or later, released at https://github.com/leepeuker/movary/releases/tag/0.71.1. The patch implements proper authorization checks in the user settings endpoint (commit 12c8a090051b1a1c07a3aa48922f3bc9ffe44c8b, pull request #750 at https://github.com/leepeuker/movary/pull/750). For environments unable to patch immediately, implement these compensating controls: (1) Use reverse proxy (nginx/Apache) to block PUT requests to /settings/users/* endpoints for non-admin source IPs via allowlist rules-trade-off is administrative overhead maintaining IP lists and breaks legitimate self-service profile edits; (2) Apply Web Application Firewall (WAF) rule to inspect PUT request bodies to /settings/users/ and reject any containing isAdmin parameter-may cause false positives if legitimate admin operations use this endpoint; (3) Audit existing user accounts for unauthorized admin escalations by querying the database for recently modified isAdmin flags and reviewing application logs for PUT requests to user settings endpoints with isAdmin in payload. Review the security advisory at https://github.com/leepeuker/movary/security/advisories/GHSA-mcfq-8rx7-w25v for additional vendor guidance.
Movary has a third input validation vulnerability that allows authenticated users to delete arbitrary files from the ser
Movary has a second input validation vulnerability allowing authenticated users to write arbitrary files on the server,
Movary movie tracking application has an input validation flaw that allows authenticated users to read arbitrary files f
Privilege escalation in Movary (self-hosted movie tracking app) versions before 0.71.1 allows any authenticated user to
Server-Side Request Forgery in Movary movie tracking application allows authenticated users to probe internal networks a
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today