Missing Authorization Vulnerability in Meelo Product by Arthi-chaud

CVE-2026-122327

What is CVE-2026-122327?

The Meelo product, up to version 3.13.1, has a vulnerability that allows authenticated non-admin users to bypass authorization checks on key endpoints. Due to inadequate implementation in the RolesGuard, users can modify shared catalog data by sending unauthorized PUT or POST requests to routes related to songs, tracks, and videos. This oversight can lead to unauthorized alterations, such as modifying genres, reassigning tracks, and merging songs, raising significant security concerns concerning user data integrity and platform stability.

References