Leepeuker vulnerabilities
We track 3 vulnerabilities in Leepeuker products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on April 18, 2026.
Latest Leepeuker vulnerabilities
- 8.8 High severity
movary: Incorrect Authorization
Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenticated user can access the user-management endpoints `/settings/users` and use them to enumerate all users and create a new administrator acc
- 8.8 High severity
movary: Missing Authorization
Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenticated user can escalate their own account to administrator by sending `isAdmin=true` to `PUT /settings/users/{userId}` for their own user ID
- 7.7 High severity
movary: Server-Side Request Forgery
Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenticated user can trigger server-side requests to arbitrary internal targets through `POST /settings/jellyfin/server-url-verify`. The endpoint