CVE-2026-40348

{
  "id": "CVE-2026-40348",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-18T00:16:38.663",
  "lastModified": "2026-10-26T22:10:00.163",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenticated user can trigger server-side requests to arbitrary internal targets through `POST /settings/jellyfin/server-url-verify`. The endpoint accepts a user-controlled URL, appends `/system/info/public`, and sends a server-side HTTP request with Guzzle. Because there is no restriction on internal hosts, loopback addresses, or private network ranges, this can be abused for SSRF and internal network probing. Any ordinary authenticated user can use this endpoint to make the server connect to arbitrary internal targets and distinguish between different network states. This enables SSRF-based internal reconnaissance, including host discovery, port-state probing, and service fingerprinting. In certain deployments, it may also be usable to reach internal administrative services or cloud metadata endpoints that are not directly accessible from the outside. Version 0.71.1 fixes the issue."
    },
    {
      "lang": "es",
      "value": "Movary es una aplicación web autoalojada para rastrear y calificar las películas vistas por un usuario. Antes de la versión 0.71.1, un usuario autenticado ordinario puede desencadenar solicitudes del lado del servidor a objetivos internos arbitrarios a través de ’POST /settings/jellyfin/server-url-verify’. El endpoint acepta una URL controlada por el usuario, añade ’/system/info/public’, y envía una solicitud HTTP del lado del servidor con Guzzle. Debido a que no hay restricciones en hosts internos, direcciones de bucle invertido o rangos de red privados, esto puede ser abusado para SSRF y sondeo de red interno. Cualquier usuario autenticado ordinario puede usar este endpoint para hacer que el servidor se conecte a objetivos internos arbitrarios y distinguir entre diferentes estados de red. Esto permite el reconocimiento interno basado en SSRF, incluyendo descubrimiento de hosts, sondeo de estado de puertos y huellas digitales de servicios. En ciertas implementaciones, también puede ser utilizable para alcanzar servicios administrativos internos o endpoints de metadatos en la nube que no son directamente accesibles desde el exterior. La versión 0.71.1 corrige el problema."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "leepeuker",
          "product": "movary",
          "versions": [
            {
              "version": "< 0.71.1",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
          "baseScore": 7.7,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 4.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-20T16:11:27.734379Z",
          "id": "CVE-2026-40348",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:leepeuker:movary:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "0.71.1",
              "matchCriteriaId": "3B267141-8A10-4807-B49C-F74FEB767E1F"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/leepeuker/movary/commit/d459b3513293d41254f7093aef07010a8e5dcf04",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/leepeuker/movary/pull/751",
      "source": "[email protected]",
      "tags": [
        "Issue Tracking",
        "Patch"
      ]
    },
    {
      "url": "https://github.com/leepeuker/movary/releases/tag/0.71.1",
      "source": "[email protected]",
      "tags": [
        "Release Notes"
      ]
    },
    {
      "url": "https://github.com/leepeuker/movary/security/advisories/GHSA-2m2v-v563-qqvj",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/leepeuker/movary/security/advisories/GHSA-2m2v-v563-qqvj",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    }
  ]
}