An authenticated user with a valid web session cookie can access the "/settings/users" page and perform actions that should be reserved for administrators. Because the route definitions lack an admin‑only middleware and the controller‑level check contains an incorrect boolean, the system incorrectly allows any user to enumerate all existing users and to create new administrator accounts. This flaw effectively permits a low‑privileged user to elevate privileges without further authentication.

Movary, self‑hosted web application for tracking movies, versions prior to 0.71.1 by vendor LeePeker.

The vulnerability has a CVSS score of 8.8, indicating high severity. The EPSS score is not available, and the issue is not listed in CISA KEV. The flaw can be exploited from any web client that has logged in, allowing an attacker to create additional administrator accounts and gain full control of the application. Because it only requires a valid authenticated session, the attack is trivial for users who already possess credentials or can obtain a session cookie through phishing or other methods. The lack of a KEV designation does not reduce the risk, as the flaw remains exploitable until patches are applied.