---
id: CVE-2026-122327
title: 'Meelo through 3.13.1 Missing Authorization on Song, Track and Video Endpoints'
summary: >-
  Meelo through 3.13.1 contains a missing authorization vulnerability that
  allows authenticated non-admin users to modify shared catalog data because
  RolesGuard does not require Admin on song, track and video write routes.
  Attackers can se…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-862
vendor: Arthi-chaud
product: Meelo
affected:
  - Meelo <= 3.13.1
published: '2026-11-05'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T15:11:45.477Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-122327'
references:
  - url: 'https://github.com/Arthi-chaud/Meelo/issues/2185'
  - url: >-
      https://github.com/Arthi-chaud/Meelo/blob/v3.13.1/server/src/authentication/roles/roles.guard.ts#L48-L117
  - url: >-
      https://github.com/Arthi-chaud/Meelo/blob/v3.13.1/server/src/song/song.controller.ts#L275-L309
  - url: >-
      https://github.com/Arthi-chaud/Meelo/blob/v3.13.1/server/src/track/track.controller.ts#L145-L160
  - url: >-
      https://github.com/Arthi-chaud/Meelo/blob/v3.13.1/server/src/video/video.controller.ts#L131-L149
  - url: 'https://hackmd.io/@hieund/meelo-catalog-metadata-write-missing-admin-authz'
  - url: 'https://github.com/Arthi-chaud/Meelo'
  - url: >-
      https://www.vulncheck.com/advisories/meelo-through-3.13.1-missing-authorization-on-song-track-and-video-endpoints
    label: >-
      VulnCheck Advisory: Meelo through 3.13.1 Missing Authorization on Song,
      Track and Video Endpoints
tags:
  - cve.org
ingestedAt: '2026-11-05T21:36:00.889Z'
epss: 0.00213
epssPercentile: 0.11719
---

## Overview

Meelo through 3.13.1 contains a missing authorization vulnerability that allows authenticated non-admin users to modify shared catalog data because RolesGuard does not require Admin on song, track and video write routes. Attackers can send PUT requests to /songs/:idOrSlug, /tracks/:idOrSlug or /videos/:idOrSlug, or POST to /songs/:idOrSlug/merge, to alter genres, reassign tracks and merge songs.

## Affected

- `Meelo <= 3.13.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.