CVE-2026-122327 · Package
NO FIX YET
Meelo, a self-hosted music server, has a missing authorization check on its song, track and video write routes. A logged-in user without admin rights can change genres, move tracks between songs and merge songs, altering catalog data for everyone.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that run a Meelo instance with more than one user account are exposed, since any authenticated non-admin user can send write requests to the affected routes. A single-user instance with only admin accounts is not exposed to this specific flaw. The sources do not name a fixed version.
Not affected if admin-only-accounts, single-user
Who cares meelo, self-hosted
3.13.1)No fix yet, per the sources.
Meelo through 3.13.1 contains a missing authorization vulnerability that allows authenticated non-admin users to modify shared catalog data because RolesGuard does not require Admin on song, track and video write routes. Attackers can send PUT requests to /songs/:idOrSlug, /tracks/:idOrSlug or /videos/:idOrSlug, or POST to /songs/:idOrSlug/merge, to alter genres, reassign tracks and merge songs.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.