A critical authorization vulnerability in Movary allows any authenticated user to elevate their privileges to administrator, posing a severe risk to system integrity and data control.

This is an incorrect authorization vulnerability (CWE-863) where the application fails to enforce admin-only middleware on the /settings/users endpoint. Any authenticated user can exploit this broken boolean check to enumerate all users and create new administrator accounts.

The ability for a standard user to create an administrator account grants them full control over the Movary instance. This leads to complete compromise of the application, including the ability to manipulate user data, access private configuration settings, and potentially pivot to the underlying server environment. Given the CVSS score of 8.8, this represents a high-severity threat that necessitates immediate remediation to prevent unauthorized administrative takeover.

Immediate Action: Update Movary to version 0.71.1 or later immediately to apply the necessary authorization middleware and correct the broken boolean condition.

Proactive Monitoring: Review audit logs for unusual account creation events, specifically looking for new administrator accounts created by non-administrative users.

Compensating Controls: Implement strict network access controls to limit access to the Movary administrative interface, or deploy a Web Application Firewall (WAF) rule to block unauthorized access attempts to the /settings/users path.

Public Exploit Available: No (exploit_available unknown).

The vulnerability presents a significant risk to the security of your Movary instance by enabling trivial privilege escalation. Administrators must prioritize updating to version 0.71.1 to address the authorization bypass. Delaying this update leaves the system exposed to malicious account creation and full administrative takeover by any existing user.