CVE-2026-122327

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-122327", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-11-04T23:26:08.935Z", "datePublished": "2026-11-05T15:11:45.477Z", "dateUpdated": "2026-11-09T22:07:29.617Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-05T15:11:45.477Z"}, "datePublic": "2026-11-05T00:00:00.000Z", "title": "Meelo through 3.13.1 Missing Authorization on Song, Track and Video Endpoints", "descriptions": [{"lang": "en", "value": "Meelo through 3.13.1 contains a missing authorization vulnerability that allows authenticated non-admin users to modify shared catalog data because RolesGuard does not require Admin on song, track and video write routes. Attackers can send PUT requests to /songs/:idOrSlug, /tracks/:idOrSlug or /videos/:idOrSlug, or POST to /songs/:idOrSlug/merge, to alter genres, reassign tracks and merge songs."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "affected": [{"vendor": "Arthi-chaud", "product": "Meelo", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThanOrEqual": "3.13.1", "status": "affected", "versionType": "semver"}], "packageURL": "pkg:github/Arthi-chaud/Meelo", "repo": "https://github.com/Arthi-chaud/Meelo"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/Arthi-chaud/Meelo/issues/2185", "tags": ["issue-tracking"]}, {"url": "https://github.com/Arthi-chaud/Meelo/blob/v3.13.1/server/src/authentication/roles/roles.guard.ts#L48-L117", "tags": ["technical-description"]}, {"url": "https://github.com/Arthi-chaud/Meelo/blob/v3.13.1/server/src/song/song.controller.ts#L275-L309", "tags": ["technical-description"]}, {"url": "https://github.com/Arthi-chaud/Meelo/blob/v3.13.1/server/src/track/track.controller.ts#L145-L160", "tags": ["technical-description"]}, {"url": "https://github.com/Arthi-chaud/Meelo/blob/v3.13.1/server/src/video/video.controller.ts#L131-L149", "tags": ["technical-description"]}, {"url": "https://hackmd.io/@hieund/meelo-catalog-metadata-write-missing-admin-authz", "tags": ["third-party-advisory"]}, {"url": "https://github.com/Arthi-chaud/Meelo", "tags": ["product"]}, {"name": "VulnCheck Advisory: Meelo through 3.13.1 Missing Authorization on Song, Track and Video Endpoints", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/meelo-through-3.13.1-missing-authorization-on-song-track-and-video-endpoints"}], "credits": [{"lang": "en", "value": "hieuPenguinnn", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"references": [{"url": "https://hackmd.io/@hieund/cve-2026-122327-meelo-catalog-metadata-write-missing-admin-authz", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-09T22:06:52.548129Z", "id": "CVE-2026-122327", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T22:07:29.617Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-122327", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-11-04T23:26:08.935Z", "datePublished": "2026-11-05T15:11:45.477Z", "dateUpdated": "2026-11-09T22:07:29.617Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-05T15:11:45.477Z"}, "datePublic": "2026-11-05T00:00:00.000Z", "title": "Meelo through 3.13.1 Missing Authorization on Song, Track and Video Endpoints", "descriptions": [{"lang": "en", "value": "Meelo through 3.13.1 contains a missing authorization vulnerability that allows authenticated non-admin users to modify shared catalog data because RolesGuard does not require Admin on song, track and video write routes. Attackers can send PUT requests to /songs/:idOrSlug, /tracks/:idOrSlug or /videos/:idOrSlug, or POST to /songs/:idOrSlug/merge, to alter genres, reassign tracks and merge songs."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "affected": [{"vendor": "Arthi-chaud", "product": "Meelo", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThanOrEqual": "3.13.1", "status": "affected", "versionType": "semver"}], "packageURL": "pkg:github/Arthi-chaud/Meelo", "repo": "https://github.com/Arthi-chaud/Meelo"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/Arthi-chaud/Meelo/issues/2185", "tags": ["issue-tracking"]}, {"url": "https://github.com/Arthi-chaud/Meelo/blob/v3.13.1/server/src/authentication/roles/roles.guard.ts#L48-L117", "tags": ["technical-description"]}, {"url": "https://github.com/Arthi-chaud/Meelo/blob/v3.13.1/server/src/song/song.controller.ts#L275-L309", "tags": ["technical-description"]}, {"url": "https://github.com/Arthi-chaud/Meelo/blob/v3.13.1/server/src/track/track.controller.ts#L145-L160", "tags": ["technical-description"]}, {"url": "https://github.com/Arthi-chaud/Meelo/blob/v3.13.1/server/src/video/video.controller.ts#L131-L149", "tags": ["technical-description"]}, {"url": "https://hackmd.io/@hieund/meelo-catalog-metadata-write-missing-admin-authz", "tags": ["third-party-advisory"]}, {"url": "https://github.com/Arthi-chaud/Meelo", "tags": ["product"]}, {"name": "VulnCheck Advisory: Meelo through 3.13.1 Missing Authorization on Song, Track and Video Endpoints", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/meelo-through-3.13.1-missing-authorization-on-song-track-and-video-endpoints"}], "credits": [{"lang": "en", "value": "hieuPenguinnn", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-122327", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-09T22:06:52.548129Z"}}}], "references": [{"url": "https://hackmd.io/@hieund/cve-2026-122327-meelo-catalog-metadata-write-missing-admin-authz", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T22:07:09.518Z"}}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:github/Arthi-chaud/Meelo", "product": "Meelo", "repo": "https://github.com/Arthi-chaud/Meelo", "vendor": "Arthi-chaud", "versions": [{"lessThanOrEqual": "3.13.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Meelo through 3.13.1 contains a missing authorization vulnerability that allows authenticated non-admin users to modify shared catalog data because RolesGuard does not require Admin on song, track and video write routes. Attackers can send PUT requests to /songs/:idOrSlug, /tracks/:idOrSlug or /videos/:idOrSlug, or POST to /songs/:idOrSlug/merge, to alter genres, reassign tracks and merge songs."}], "id": "CVE-2026-122327", "lastModified": "2026-11-12T21:09:09.470", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-122327", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-09T22:06:52.548129Z", "version": "2.0.3"}}]}, "published": "2026-11-05T16:17:45.677", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/Arthi-chaud/Meelo"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/Arthi-chaud/Meelo/blob/v3.13.1/server/src/authentication/roles/roles.guard.ts#L48-L117"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/Arthi-chaud/Meelo/blob/v3.13.1/server/src/song/song.controller.ts#L275-L309"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/Arthi-chaud/Meelo/blob/v3.13.1/server/src/track/track.controller.ts#L145-L160"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/Arthi-chaud/Meelo/blob/v3.13.1/server/src/video/video.controller.ts#L131-L149"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/Arthi-chaud/Meelo/issues/2185"}, {"source": "disclosure@vulncheck.com", "url": "https://hackmd.io/@hieund/meelo-catalog-metadata-write-missing-admin-authz"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/meelo-through-3.13.1-missing-authorization-on-song-track-and-video-endpoints"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://hackmd.io/@hieund/cve-2026-122327-meelo-catalog-metadata-write-missing-admin-authz"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "Meelo: Meelo: Unauthorized catalog modification via missing access control", "id": "2567592", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567592"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "status": "draft"}, "cwe": "CWE-425", "details": ["A flaw was found in Meelo. The application fails to properly enforce administrative authorization checks on write routes for songs, tracks, and videos. An authenticated remote user with standard privileges can exploit this issue by submitting modification requests to these endpoints, allowing them to alter shared catalog metadata, reassign tracks, or merge media entries without proper permissions."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-122327", "public_date": "2026-11-05T15:11:45Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-122327\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-122327\nhttps://github.com/Arthi-chaud/Meelo\nhttps://github.com/Arthi-chaud/Meelo/blob/v3.13.1/server/src/authentication/roles/roles.guard.ts#L48-L117\nhttps://github.com/Arthi-chaud/Meelo/blob/v3.13.1/server/src/song/song.controller.ts#L275-L309\nhttps://github.com/Arthi-chaud/Meelo/blob/v3.13.1/server/src/track/track.controller.ts#L145-L160\nhttps://github.com/Arthi-chaud/Meelo/blob/v3.13.1/server/src/video/video.controller.ts#L131-L149\nhttps://github.com/Arthi-chaud/Meelo/issues/2185\nhttps://hackmd.io/@hieund/meelo-catalog-metadata-write-missing-admin-authz\nhttps://www.vulncheck.com/advisories/meelo-through-3.13.1-missing-authorization-on-song-track-and-video-endpoints"], "statement": "This vulnerability is rated with a Moderate severity impact because exploitation requires authenticated user access and the blast radius is confined to altering media library metadata without compromising system availability or host confidentiality. Furthermore, the affected Meelo software is not packaged, distributed, or supported across Red Hat product portfolios.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,3.13.1]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Meelo", "source": "cna", "vendor": "Arthi-chaud"}, "product": "meelo", "vendor": "arthi-chaud"}], "created": "2026-11-05T16:45:06.275759+00:00", "updated": "2026-11-06T21:14:13.067134+00:00", "vendors": ["arthi-chaud", "arthi-chaud$PRODUCT$meelo"]}