CVE-2026-122327
Description
A flaw was found in Meelo. The application fails to properly enforce administrative authorization checks on write routes for songs, tracks, and videos. An authenticated remote user with standard privileges can exploit this issue by submitting modification requests to these endpoints, allowing them to alter shared catalog metadata, reassign tracks, or merge media entries without proper permissions.
Statement
This vulnerability is rated with a Moderate severity impact because exploitation requires authenticated user access and the blast radius is confined to altering media library metadata without compromising system availability or host confidentiality. Furthermore, the affected Meelo software is not packaged, distributed, or supported across Red Hat product portfolios.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability,Access Control
Technical Impact: Read Application Data; Modify Application Data; Execute Unauthorized Code or Commands; Gain Privileges or Assume Identity
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
