CVE-2026-40350

OVERVIEW CVE-2026-40350 is a critical authorization bypass vulnerability affecting Movary, a self-hosted web application for tracking and rating movies. Authenticated users can exploit broken authorization controls at the user-management endpoints to enumerate all system users and create new administrator accounts without proper privilege escalation, affecting all versions prior to 0.71.1. SEVERITY The vulnerability carries a CVSS 3.1 score of 8.8 (HIGH) with network accessibility, low attack complexity, and low privilege requirements. An attacker needs only a valid web session cookie from any authenticated user account to access restricted functionality. The impact is severe across all three dimensions: confidentiality (user enumeration), integrity (unauthorized account creation and privilege elevation), and availability (potential system compromise). EXPLOITATION STATUS There is no evidence of active exploitation in the wild, and the vulnerability does not appear on the Known Exploited Vulnerabilities catalog. While the EPSS score of 0.0004 indicates extremely low probability of near-term exploitation relative to other CVEs, this metric should not drive urgency given the straightforward nature of the attack and high impact potential. No significant community attention has been documented. Organizations running Movary should prioritize patching to version 0.71.1 immediately.