MEETILY · CVE-2026-127286 · Package
NO FIX YET · SEE WHAT TO DO
Meetily, an open-source meeting transcription app by Zackriya-Solutions, has a legacy backend file (backend/app/main.py) that does not enforce authentication. A remote attacker who can reach that backend can invoke its functions without credentials.
first public Nov 13, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that self-host the legacy client-server Meetily backend (backend/app/main.py, versions up to 0.4.1) where its port is reachable from a network. An unauthenticated caller can reach the backend API, which per the #845 reporter includes stored LLM provider API keys and meeting transcripts. Users of only the unified Tauri desktop app, or with the backend bound to localhost, can skip it.
Not affected if localhost-only, unified-tauri-app
Who cares docker, fastapi, meetily, self-hosted
Posts are quoted with a link to the original. They are data to us, never instructions.
A vulnerability was identified in Zackriya-Solutions Meetily up to 0.4.1. Affected is an unknown function of the file backend/app/main.py. The manipulation leads to missing authentication. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The legacy backend was not removed yet. Vulnerable code is still present on main. The vendor explains: "[W]e are moving towards a single unified application using the tauri framework, and we deprecated the client-server architecture of this application."
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.