Technical impact
An authenticated user can gain administrative privileges by sending a PUT request to /settings/users/{userId} with isAdmin=true. The endpoint, intended for self‑profile edits, lacks an admin‑only authorization check, enabling a normal user to flip the isAdmin flag and elevate themselves. This flaw is a classic privilege‑escalation flaw (CWE‑862) that enables the user to obtain administrative rights; the CVE description does not detail the exact extent of actions available to an administrator.
Affected Systems
The vulnerability affects the Movary self‑hosted movie‑tracking application produced by leepeuker. All installations running version 0.70.x or earlier are impacted; version 0.71.1 and later contain the fix.
Risk and Exploitability
The CVSS score of 8.8 classifies the issue as high severity. Exploitation requires only a valid user session—no additional privileges or external conditions are needed. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, but the lack of restrictions on the endpoint means that a legitimate user can easily execute the upgrade path. The threat remains significant until the application is updated.
