CVE-2026-122327

Meelo through 3.13.1 contains a missing authorization vulnerability that allows authenticated non-admin users to modify shared catalog data because RolesGuard does not require Admin on song, track and video write routes. Attackers can send PUT requests to /songs/:idOrSlug, /tracks/:idOrSlug or...

EUVD-2026-117535

Meelo through 3.13.1 contains a missing authorization vulnerability that allows authenticated non-admin users to modify shared catalog data because RolesGuard does not require Admin on song, track and video write routes. Attackers can send PUT requests to /songs/:idOrSlug, /tracks/:idOrSlug or...

CVE-2026-122327 Meelo through 3.13.1 Missing Authorization on Song, Track and Video Endpoints

Meelo through 3.13.1 contains a missing authorization vulnerability that allows authenticated non-admin users to modify shared catalog data because RolesGuard does not require Admin on song, track and video write routes. Attackers can send PUT requests to /songs/:idOrSlug, /tracks/:idOrSlug or...

CVE-2026-122327

The Meelo application (through version 3.13.1 ) contains a missing authorization vulnerability (CWE-862) because the RolesGuard fails to require Admin privileges on specific write routes. This allows authenticated non-admin users to modify shared catalog data by sending PUT requests to /songs/:id...

CVE-2026-122327 Meelo through 3.13.1 Missing Authorization on Song, Track and Video Endpoints

Meelo through 3.13.1 contains a missing authorization vulnerability that allows authenticated non-admin users to modify shared catalog data because RolesGuard does not require Admin on song, track and video write routes. Attackers can send PUT requests to /songs/:idOrSlug, /tracks/:idOrSlug or...