{"id":"CVE-2026-122327","title":"Meelo through 3.13.1 Missing Authorization on Song, Track and Video Endpoints","summary":"Meelo through 3.13.1 contains a missing authorization vulnerability that allows authenticated non-admin users to modify shared catalog data because RolesGuard does not require Admin on song, track and video write routes. Attackers can se…","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvssSource":"cna","cwe":["CWE-862"],"vendor":"Arthi-chaud","product":"Meelo","affected":["Meelo <= 3.13.1"],"published":"2026-11-05","updated":"2026-11-05","sourceUpdated":"2026-11-05T15:11:45.477Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-122327","references":[{"url":"https://github.com/Arthi-chaud/Meelo/issues/2185"},{"url":"https://github.com/Arthi-chaud/Meelo/blob/v3.13.1/server/src/authentication/roles/roles.guard.ts#L48-L117"},{"url":"https://github.com/Arthi-chaud/Meelo/blob/v3.13.1/server/src/song/song.controller.ts#L275-L309"},{"url":"https://github.com/Arthi-chaud/Meelo/blob/v3.13.1/server/src/track/track.controller.ts#L145-L160"},{"url":"https://github.com/Arthi-chaud/Meelo/blob/v3.13.1/server/src/video/video.controller.ts#L131-L149"},{"url":"https://hackmd.io/@hieund/meelo-catalog-metadata-write-missing-admin-authz"},{"url":"https://github.com/Arthi-chaud/Meelo"},{"url":"https://www.vulncheck.com/advisories/meelo-through-3.13.1-missing-authorization-on-song-track-and-video-endpoints","label":"VulnCheck Advisory: Meelo through 3.13.1 Missing Authorization on Song, Track and Video Endpoints"}],"tags":["cve.org"],"ingestedAt":"2026-11-05T21:36:00.889Z","epss":0.00213,"epssPercentile":0.11719,"slug":"CVE-2026-122327","body":"## Overview\n\nMeelo through 3.13.1 contains a missing authorization vulnerability that allows authenticated non-admin users to modify shared catalog data because RolesGuard does not require Admin on song, track and video write routes. Attackers can send PUT requests to /songs/:idOrSlug, /tracks/:idOrSlug or /videos/:idOrSlug, or POST to /songs/:idOrSlug/merge, to alter genres, reassign tracks and merge songs.\n\n## Affected\n\n- `Meelo <= 3.13.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}