CVE-2026-122327 Meelo through 3.13.1 Missing Authorization on Song, Track and Video Endpoints
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-122327?
CVE-2026-122327 is a medium-severity vulnerability in Arthi-chaud Meelo, published on 5 Nov 2026.
Official description
Meelo through 3.13.1 contains a missing authorization vulnerability that allows authenticated non-admin users to modify shared catalog data because RolesGuard does not require Admin on song, track and video write routes. Attackers can send PUT requests to /songs/:idOrSlug, /tracks/:idOrSlug or /videos/:idOrSlug, or POST to /songs/:idOrSlug/merge, to alter genres, reassign tracks and merge songs.
Weakness: CWE-862
Which versions are affected by CVE-2026-122327?
How do I fix CVE-2026-122327?
No fix has been published for CVE-2026-122327 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-122327 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-122327 exists.
Sources
Also known as GHSA-xxcj-wcr3-qvg7.