EUVD-2026-23619

Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenticated user can escalate their own account to administrator by sending isAdmin=true to PUT /settings/users/userId for their own user ID. The endpoint is intended to let a user ed...

CVE-2026-23840

CVE-2026-23840 affects Movary, a web application for tracking movie history. The issue arises from insufficient input validation in the vulnerable parameter ?categoryDeleted=, allowing cross-site scripting (XSS) payloads in versions prior to 0.70.0. The Red Hat/NVD/CVE data consistently state tha...