CVE-2026-40350 affects Movary, a self-hosted web application for tracking and rating movies. Prior to version 0.71.1, an authenticated user could exploit broken authorization controls to access admin-only endpoints at /settings/users. This vulnerability allows ordinary users to enumerate all users and create new administrator accounts due to missing admin middleware enforcement and faulty boolean conditions in controller authorization checks. Any user with a valid session cookie could escalate privileges to administrator level. The issue has been patched in version 0.71.1.