TI-2026-85472 CVE-2026-122327 · GHSA-xxcj-wcr3-qvg7
Missing authorization in Meelo lets users modify shared catalog data
Priority LOW 23
Meelo through 3.13.1 contains a missing authorization vulnerability that allows authenticated non-admin users to modify shared catalog data because RolesGuard does not require Admin on song, track and video write routes.