An authenticated user can perform a privilege escalation attack in Movary prior to version 0.71.1, potentially granting them full administrative control over the application.

The application suffers from a missing authorization vulnerability (CWE-862) within the PUT /settings/users/{userId} endpoint, which fails to verify administrative privileges when updating the isAdmin field. This allows any authenticated user to elevate their own account status by supplying an isAdmin=true parameter during a profile update.

Successful exploitation of this vulnerability results in full administrative access to the Movary instance. This compromise allows an attacker to manipulate user data, modify system configurations, and potentially access sensitive information, leading to a complete loss of confidentiality, integrity, and availability. With a CVSS score of 8.8, this flaw represents a High severity risk that requires immediate attention to prevent unauthorized escalation.

Immediate Action: Update Movary to version 0.71.1 or later to apply the necessary authorization checks for the user settings endpoint.

Proactive Monitoring: Review application access logs for unexpected PUT requests to the /settings/users/ endpoint, particularly those originating from non-administrative user accounts.

Compensating Controls: Implement strict network access controls or place the application behind a Web Application Firewall (WAF) to restrict access to sensitive management endpoints.

Public Exploit Available: No

Given the ease with which an authenticated user can achieve full administrative control, organizations running Movary must prioritize upgrading to version 0.71.1. Failure to patch this flaw leaves the application susceptible to total compromise by any user with a standard account.