| Package | Affected versions | Patched versions |
|---|---|---|
| movary | < 0.71.1 | 0.71.1 |
Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenticated user can access the user-management endpoints `/settings/users` and use them to enumerate all users and create a new administrator account. This happens because the route definitions do not enforce admin-only middleware, and the controller-level authorization check uses a broken boolean condition. As a result, any user with a valid web session cookie can reach functionality that should be restricted to administrators. Version 0.71.1 patches the issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free