CVE-2026-16224

MEDIUM

jxxghp MoviePilot Application API improper authorization

Title source: cna
STIX 2.1

Description

A vulnerability was identified in jxxghp MoviePilot up to 2.13.5. The affected element is an unknown function of the file /jxxghp/MoviePilot of the component Application API. The manipulation leads to improper authorization. Remote exploitation of the attack is possible. The identifier of the patch is dc2b6910a423b3bfadeffaa303e1ba75cfb33900. Applying a patch is the recommended action to fix this issue.

References (7)

Core 7
Core References
Vdb Entry vdb-entry
VDB-380046 | jxxghp MoviePilot Application API improper authorization
https://vuldb.com/vuln/380046
Signature, Permissions Required signature permissions-required
VDB-380046 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/380046/cti
Third Party Advisory third-party-advisory
CVE-2026-16224 | CVE Analysis and Report
https://vuldb.com/cve/CVE-2026-16224
Third Party Advisory third-party-advisory
Submit #858227 | jxxghp MoviePilot v2.13.5 Missing Authorization
https://vuldb.com/submit/858227
Issue Tracking issue-tracking
https://github.com/jxxghp/MoviePilot/issues/5916

Scores

CVSS v3 4.3
EPSS 0.0022
EPSS Percentile 12.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-266 CWE-285
Status published
Products (6)
jxxghp/MoviePilot 2.13.0
jxxghp/MoviePilot 2.13.1
jxxghp/MoviePilot 2.13.2
jxxghp/MoviePilot 2.13.3
jxxghp/MoviePilot 2.13.4
jxxghp/MoviePilot 2.13.5
Published Jul 19, 2026
Tracked Since Jul 19, 2026