CVE-2026-40349 is a missing authorization vulnerability (CWE-862) in the movary web application before version 0.71.1. The PUT /settings/users/{userId} endpoint intended for users to edit their own profile fails to restrict changes to the sensitive isAdmin field. As a result, an authenticated user can escalate their privileges to administrator by setting isAdmin=true in their own user update request. This vulnerability has a CVSS 3.1 score of 8.8, indicating high severity due to network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. The issue is fixed in movary version 0.71.1.

Exploitation allows an authenticated user to gain administrator privileges, potentially leading to full control over the application, including unauthorized access to sensitive data and administrative functions. The vulnerability affects confidentiality, integrity, and availability of the movary application.

Upgrade movary to version 0.71.1 or later, where this authorization flaw is patched. Since the vendor advisory or patch links are not explicitly provided, users should verify the update from the official source. Patch status is not yet confirmed via vendor advisory; check the vendor's official channels for the latest remediation guidance.