The flaw is an improper authorization weakness in the MoviePilot application API. It originates from missing or incorrect access checks, effectively creating an authorization bypass. This vulnerability is classified under CWE‑266 (Least Privilege Error) and CWE‑285 (Improper Privilege Management), indicating that the system fails to enforce the principle of least privilege and fails to manage privilege assignments correctly. A remote attacker can manipulate an undisclosed API function to perform actions or access data beyond their permissions, which can compromise confidentiality, integrity, and availability of the system.

All installations of the jxxghp MoviePilot application up to and including version 2.13.5 are vulnerable. The affected component is the Application API. Any deployment running 2.13.5 or earlier should be considered at risk until the patch commit dc2b6910a423b3bfadeffaa303e1ba75cfb33900 is applied.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of <1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, meaning no publicly known exploits are currently tracked. Attackers can exploit it remotely by interacting with exposed API endpoints over the network. The provided patch corrects the authorization logic, thereby mitigating the risk.