https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-40350.htmlhttps://patchthecve.com/cve/CVE-2026-40350.htmlMon, 26 Oct 2026 21:10:00 +0000HIGH 8.8: Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenticated user can access the user-management endpoints `/settings/users` and use them to enumerate all users and create a new administrator account. This happens because the route defhttps://patchthecve.com/cve/CVE-2026-40349.htmlhttps://patchthecve.com/cve/CVE-2026-40349.htmlMon, 26 Oct 2026 21:10:00 +0000HIGH 8.8: Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenticated user can escalate their own account to administrator by sending `isAdmin=true` to `PUT /settings/users/{userId}` for their own user ID. The endpoint is intended to let a userhttps://patchthecve.com/cve/CVE-2026-40348.htmlhttps://patchthecve.com/cve/CVE-2026-40348.htmlMon, 26 Oct 2026 22:10:00 +0000HIGH 7.7: Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenticated user can trigger server-side requests to arbitrary internal targets through `POST /settings/jellyfin/server-url-verify`. The endpoint accepts a user-controlled URL, appends `