EUVD-2026-23632Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
8DescriptionGitHub Advisory
Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenticated user can access the user-management endpoints /settings/users and use them to enumerate all users and create a new administrator account. This happens because the route definitions do not enforce admin-only middleware, and the controller-level authorization check uses a broken boolean condition. As a result, any user with a valid web session cookie can reach functionality that should be restricted to administrators. Version 0.71.1 patches the issue.
AnalysisAI
Privilege escalation in Movary (self-hosted movie tracking app) versions before 0.71.1 allows any authenticated user to create administrator accounts and access user-management functions. The vulnerability stems from missing middleware enforcement and a broken boolean condition in authorization checks for /settings/users endpoints. Attack requires only low-privilege authenticated access (CVSS PR:L) with no user interaction (UI:N), enabling complete system takeover (C:H/I:H/A:H). Vendor has released patch version 0.71.1. No public exploit identified at time of analysis, but exploitation is trivial given the simple bypass mechanism.
Technical ContextAI
Movary is a self-hosted PHP web application for tracking watched movies (cpe:2.3:a:leepeuker:movary). This vulnerability represents CWE-863 (Incorrect Authorization), a common web application flaw where authorization logic fails to properly enforce access controls. The specific failure occurs at two levels: route definitions lack admin-only middleware that should intercept requests before reaching controller logic, and the controller-level authorization check contains a defective boolean condition that incorrectly evaluates privileges. The /settings/users endpoint family handles sensitive user-management operations including user enumeration and administrative account creation. In secure implementations, these operations require both route-level middleware checks (verifying admin role before routing) and defense-in-depth controller checks. The broken boolean condition suggests a logic error such as using OR instead of AND operators, inverted conditionals, or incorrect role comparison that causes the check to pass for non-admin users.
RemediationAI
Upgrade immediately to Movary version 0.71.1 or later, available at https://github.com/leepeuker/movary/releases/tag/0.71.1. The patch (commit 92c7400486f5fe9f350046e04e45a8502778bf39, detailed in PR #749) adds proper admin-only middleware to user-management routes and corrects the controller-level authorization boolean logic. For environments unable to patch immediately, implement these compensating controls: restrict network access to /settings/users/* endpoints via reverse proxy rules (nginx location blocks or Apache mod_rewrite) to only trusted admin IP addresses - this prevents remote privilege escalation but does not address insider threats from authenticated users on the same network; audit existing user accounts for unauthorized administrator accounts created via this exploit vector by reviewing user role assignments in the database; implement web application firewall rules to block POST requests to /settings/users from non-admin session tokens if session data includes role information - this requires custom WAF logic and may break legitimate functionality if role detection is imperfect. Note that all workarounds provide only partial protection and introduce operational complexity; upgrading to 0.71.1 is strongly preferred.
Movary has a third input validation vulnerability that allows authenticated users to delete arbitrary files from the ser
Movary has a second input validation vulnerability allowing authenticated users to write arbitrary files on the server,
Movary movie tracking application has an input validation flaw that allows authenticated users to read arbitrary files f
Authenticated users in Movary (self-hosted movie tracking web app) can escalate privileges to administrator via a missin
Server-Side Request Forgery in Movary movie tracking application allows authenticated users to probe internal networks a
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today