{"id":"CVE-2026-122327","aliases":["EUVD-2026-117535","GHSA-xxcj-wcr3-qvg7"],"status":"published","title":"Meelo through 3.13.1 Missing Authorization on Song, Track and Video Endpoints","description":"Meelo through 3.13.1 contains a missing authorization vulnerability that allows authenticated non-admin users to modify shared catalog data because RolesGuard does not require Admin on song, track and video write routes. Attackers can send PUT requests to /songs/:idOrSlug, /tracks/:idOrSlug or /videos/:idOrSlug, or POST to /songs/:idOrSlug/merge, to alter genres, reassign tracks and merge songs.","severity":{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-14","score":0.00244,"percentile":0.15692,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2026-11-05T15:11:45Z","modified":"2026-11-10T10:46:11Z","products":[{"vendor":"arthi-chaud","product":"meelo"}],"references":[{"url":"https://github.com/Arthi-chaud/Meelo/issues/2185","tags":["issue-tracking","report"]},{"url":"https://github.com/Arthi-chaud/Meelo/blob/v3.13.1/server/src/authentication/roles/roles.guard.ts#L48-L117","tags":["technical-description","article"]},{"url":"https://github.com/Arthi-chaud/Meelo/blob/v3.13.1/server/src/song/song.controller.ts#L275-L309","tags":["technical-description","article"]},{"url":"https://github.com/Arthi-chaud/Meelo/blob/v3.13.1/server/src/track/track.controller.ts#L145-L160","tags":["technical-description","article"]},{"url":"https://github.com/Arthi-chaud/Meelo/blob/v3.13.1/server/src/video/video.controller.ts#L131-L149","tags":["technical-description","article"]},{"url":"https://hackmd.io/@hieund/meelo-catalog-metadata-write-missing-admin-authz","tags":["third-party-advisory","advisory"]},{"url":"https://github.com/Arthi-chaud/Meelo","tags":["product","package"]},{"url":"https://www.vulncheck.com/advisories/meelo-through-3.13.1-missing-authorization-on-song-track-and-video-endpoints","tags":["third-party-advisory","advisory"]},{"url":"https://hackmd.io/@hieund/cve-2026-122327-meelo-catalog-metadata-write-missing-admin-authz","tags":["exploit","evidence"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122327","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xxcj-wcr3-qvg7"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/122xxx/CVE-2026-122327.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-122327","title":"Meelo through 3.13.1 Missing Authorization on Song, Track and Video Endpoints","description":"Meelo through 3.13.1 contains a missing authorization vulnerability that allows authenticated non-admin users to modify shared catalog data because RolesGuard does not require Admin on song, track and video write routes. Attackers can send PUT requests to /songs/:idOrSlug, /tracks/:idOrSlug or /videos/:idOrSlug, or POST to /songs/:idOrSlug/merge, to alter genres, reassign tracks and merge songs.","status":"published","published":"2026-11-05T15:11:45.477Z","modified":"2026-11-09T22:07:29.617Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-09T23:35:21.703923Z"}],"euvd":[{"id":"EUVD-2026-117535","description":"Meelo through 3.13.1 contains a missing authorization vulnerability that allows authenticated non-admin users to modify shared catalog data because RolesGuard does not require Admin on song, track and video write routes. Attackers can send PUT requests to /songs/:idOrSlug, /tracks/:idOrSlug or /videos/:idOrSlug, or POST to /songs/:idOrSlug/merge, to alter genres, reassign tracks and merge songs.","status":"published","published":"2026-11-05T15:11:45Z","modified":"2026-11-09T22:07:29Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-09T23:18:32.235826Z"}],"ghsa":[{"id":"GHSA-xxcj-wcr3-qvg7","title":"Meelo through 3.13.1 contains a missing authorization vulnerability that allows authenticated non...","description":"Meelo through 3.13.1 contains a missing authorization vulnerability that allows authenticated non-admin users to modify shared catalog data because RolesGuard does not require Admin on song, track and video write routes. Attackers can send PUT requests to /songs/:idOrSlug, /tracks/:idOrSlug or /videos/:idOrSlug, or POST to /songs/:idOrSlug/merge, to alter genres, reassign tracks and merge songs.","status":"published","published":"2026-11-05T18:33:13Z","modified":"2026-11-10T00:32:36Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-10T00:50:52.87263Z"}],"nvd":[{"id":"CVE-2026-122327","description":"Meelo through 3.13.1 contains a missing authorization vulnerability that allows authenticated non-admin users to modify shared catalog data because RolesGuard does not require Admin on song, track and video write routes. Attackers can send PUT requests to /songs/:idOrSlug, /tracks/:idOrSlug or /videos/:idOrSlug, or POST to /songs/:idOrSlug/merge, to alter genres, reassign tracks and merge songs.","status":"published","published":"2026-11-05T16:17:45.677Z","modified":"2026-11-12T21:09:09.47Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-09T23:16:05.167043Z"}],"osv":[{"id":"CVE-2026-122327","title":"Meelo through 3.13.1 Missing Authorization on Song, Track and Video Endpoints","description":"Meelo through 3.13.1 contains a missing authorization vulnerability that allows authenticated non-admin users to modify shared catalog data because RolesGuard does not require Admin on song, track and video write routes. Attackers can send PUT requests to /songs/:idOrSlug, /tracks/:idOrSlug or /videos/:idOrSlug, or POST to /songs/:idOrSlug/merge, to alter genres, reassign tracks and merge songs.","status":"published","published":"2026-11-05T15:11:45.477Z","modified":"2026-11-14T02:30:33.950917181Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-10T10:57:25.458985Z"}]}}