Read the docs
TI-2026-29123 Aliases CVE-2026-40348

Movary has Authenticated SSRF via Jellyfin Server URL Verification that Allows Internal Network Probing

Priority HIGH 67CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-918 and the CVSS impact.

Summary

Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenticated user can trigger server-side requests to arbitrary internal targets through `POST /settings/jellyfin/server-url-verify`. The endpoint accepts a user-controlled URL, appends `/system/info/public`, and sends a server-side HTTP request with Guzzle. Because there is no restriction on internal hosts, loopback addresses, or private network ranges, this can be abused for SSRF and internal network probing. Any ordinary authenticated user can use this endpoint to make the server connect to arbitrary internal targets and distinguish between different network states. This enables SSRF-based internal reconnaissance, including host discovery, port-state probing, and service fingerprinting. In certain deployments, it may also be usable to reach internal administrative services or cloud metadata endpoints that are not directly accessible from the outside. Version 0.71.1 fixes the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00379 32nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed movary (leepeuker): 0.71.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
leepeukermovarybefore 0.71.10.71.1Patch availableCNA
  • movary Vendorleepeuker Affected before 0.71.1 Fixed in 0.71.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:leepeuker:movary:*:*:*:*:*:*:*:*before 0.71.1Vulnerableleepeuker
  • cpe:2.3:a:leepeuker:movary:*:*:*:*:*:*:*:* Versions before 0.71.1 Vulnerable ·leepeuker

Remediation

  • Fix · CNA movary (leepeuker) Fixed in 0.71.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-40348

References

Exploit 1

Patch 2

Other 1

  • TI-2026-19203 Movary vulnerable to Cross-site Scripting with `?categoryDeleted=` param CVSS 3.1CRITICAL 9.3
  • TI-2026-19202 Movary vulnerable to Cross-site Scripting with `?categoryUpdated=` param CVSS 3.1CRITICAL 9.3
  • TI-2026-29125 Incorrect authorization in leepeuker movary CVSS 3.1HIGH 8.8
  • TI-2026-29124 Authenticated Movary User Can Self-Escalate to Administrator via PUT /settings/users/{userId} by Setting isAdmin=true CVSS 3.1HIGH 8.8
  • TI-2025-39567 Movary vulnerable to an open redirect CVSS 4.0MEDIUM 5.1
  • TI-2026-19204 Movary vulnerable to Cross-site Scripting with `?categoryCreated=` param CVSS 3.1CRITICAL 9.3
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences