jxxghp MoviePilot Improper Authorization Vulnerability in Application API

A vulnerability allowing improper authorization has been identified in jxxghp MoviePilot versions through 2.13.5. The issue resides in an unknown function within the Application API component, specifically in the file /jxxghp/MoviePilot. This vulnerability allows for remote exploitation.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive system endpoints, allowing authenticated users to read all system settings and secrets.

Reproduction

To reproduce this vulnerability, authenticate as a non-admin user and access the sensitive system endpoints that are supposed to be restricted to admins. This can be done by sending a request to the endpoint '/api/v1/system/env' or similar endpoints that require admin privileges.

Remediation

Users are advised to update to the latest version of jxxghp MoviePilot, where this vulnerability has been fixed.