7 matches found
CVE-2026-122327
A flaw was found in Meelo. The application fails to properly enforce administrative authorization checks on write routes for songs, tracks, and videos. An authenticated remote user with standard privileges can exploit this issue by submitting modification requests to these endpoints, allowing the...
CVE-2026-122327
Meelo through 3.13.1 contains a missing authorization vulnerability that allows authenticated non-admin users to modify shared catalog data because RolesGuard does not require Admin on song, track and video write routes. Attackers can send PUT requests to /songs/:idOrSlug, /tracks/:idOrSlug or...
CVE-2026-122327 Meelo through 3.13.1 Missing Authorization on Song, Track and Video Endpoints
Meelo through 3.13.1 contains a missing authorization vulnerability that allows authenticated non-admin users to modify shared catalog data because RolesGuard does not require Admin on song, track and video write routes. Attackers can send PUT requests to /songs/:idOrSlug, /tracks/:idOrSlug or...
EUVD-2026-117535
Meelo through 3.13.1 contains a missing authorization vulnerability that allows authenticated non-admin users to modify shared catalog data because RolesGuard does not require Admin on song, track and video write routes. Attackers can send PUT requests to /songs/:idOrSlug, /tracks/:idOrSlug or...
CVE-2026-122327
The Meelo application (through version 3.13.1 ) contains a missing authorization vulnerability (CWE-862) because the RolesGuard fails to require Admin privileges on specific write routes. This allows authenticated non-admin users to modify shared catalog data by sending PUT requests to /songs/:id...
CVE-2026-122327 Meelo through 3.13.1 Missing Authorization on Song, Track and Video Endpoints
Meelo through 3.13.1 contains a missing authorization vulnerability that allows authenticated non-admin users to modify shared catalog data because RolesGuard does not require Admin on song, track and video write routes. Attackers can send PUT requests to /songs/:idOrSlug, /tracks/:idOrSlug or...
WordPress Meelo - Corporate One Page WordPress theme theme <= 1.4 - Local File Inclusion vulnerability
WordPress Meelo - Corporate One Page WordPress theme theme = 1.4 - Local File Inclusion vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Meelo - Corporate One Page WordPress Theme versions = 1.4...