How to fix CVE-2026-40349?

Within 24 hours: Inventory all Movary instances and confirm versions currently deployed. Within 7 days: Upgrade all Movary installations to version 0.71.1 or later. Immediately after patching, audit user accounts and permission logs for unauthorized administrative privilege grants. Within 30 days: Conduct post-incident review of administrative account changes and implement logging/alerting on privilege modification endpoints.

Is Movary affected by CVE-2026-40349?

Movary self-hosted movie tracking application versions prior to 0.71.1 contain a critical privilege escalation vulnerability allowing authenticated users to arbitrarily grant themselves administrator access through a missing authorization control.

Movary CVE-2026-40349

EUVD-2026-23619 HIGH

Missing Authorization (CWE-862)

2026-04-18 GitHub_M

Authentication Bypass

8.8

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Apr 18, 2026 - 01:01 EUVD

Analysis Updated

Apr 18, 2026 - 00:27 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 18, 2026 - 00:22 vuln.today

cvss_changed

Analysis Generated

Apr 18, 2026 - 00:18 vuln.today

DescriptionNVD

Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenticated user can escalate their own account to administrator by sending isAdmin=true to PUT /settings/users/{userId} for their own user ID. The endpoint is intended to let a user edit their own profile, but it updates the sensitive isAdmin field without any admin-only authorization check. Version 0.71.1 patches the issue.

AnalysisAI

Authenticated users in Movary (self-hosted movie tracking web app) can escalate privileges to administrator via a missing authorization check in the user settings endpoint. By sending a crafted PUT request to /settings/users/{userId} with isAdmin=true for their own user ID, low-privilege users gain full administrative access. …

RemediationAI

Within 24 hours: Inventory all Movary instances and confirm versions currently deployed. Within 7 days: Upgrade all Movary installations to version 0.71.1 or later. …

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

CVE-2026-40349 vulnerability details – vuln.today

Back

Movary CVE-2026-40349

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

RemediationAI

Full analysis requires sign-in

Share

External POC / Exploit Code