{"id":"CVE-2026-127286","kind":"vulnerability","aliases":["CVE-2026-127286"],"related":[],"title":"Meetily: legacy backend in main.py lacks authentication, reachable remotely","description":"A vulnerability was identified in Zackriya-Solutions Meetily up to 0.4.1. Affected is an unknown function of the file backend/app/main.py. The manipulation leads to missing authentication. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The legacy backend was not removed yet. Vulnerable code is still present on main. The vendor explains: \"[W]e are moving towards a single unified application using the tauri framework, and we deprecated the client-server architecture of this application.\"","summary":"Meetily, an open-source meeting transcription app by Zackriya-Solutions, has a legacy backend file (backend/app/main.py) that does not enforce authentication. A remote attacker who can reach that backend can invoke its functions without credentials.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"meetily","fixed":[],"affected":"<= 0.4.1","ecosystem":"github"}],"ecosystems":[],"tags":["docker","fastapi","meetily","package","self-hosted"],"not_affected_if":["localhost-only","unified-tauri-app"],"how_to_check":"- Look for a running legacy Meetily backend: a FastAPI service from backend/app/main.py, or the project's Docker Compose stack publishing its port (reporter says it binds 0.0.0.0 and publishes on all interfaces).\n- From another machine, try the backend's port without credentials; any answer from its API routes means it is exposed.\n- Meetily installs that only use the unified Tauri desktop app do not run this backend. Whether the code is gone from main is unconfirmed: NVD says it is still present, the maintainer says the report does not refer to the current codebase.\n- Workaround (not vendor-stated): bind to 127.0.0.1 or firewall the port.","fix":"No fix. Maintainers closed the reports as not planned (#845) because the client-server backend is deprecated in favour of the unified Tauri app. Stop running the legacy backend, or keep it off the network.","status":"open","published_at":"2026-11-13T03:17:30+00:00","first_seen_at":"2026-11-13T03:42:55+00:00","triaged_at":"2026-11-13T03:43:20+00:00","updated_at":"2026-11-13T03:45:12+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T03:43:20Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"internet","title":"Meetily: legacy backend in main.py lacks authentication, reachable remotely","impact":"medium","summary":"Meetily, an open-source meeting transcription app by Zackriya-Solutions, has a legacy backend file (backend/app/main.py) that does not enforce authentication. A remote attacker who can reach that backend can invoke its functions without credentials.","audience":"developers","category":"package","nicknames":[],"who_cares":["meetily","self-hosted"],"confidence":0.6,"fix_status":"none","needs_auth":"no","worst_case":"unauthenticated remote callers reach backend functions","analyst_note":"Confirm which Meetily versions expose backend/app/main.py over the network and whether any fixed version exists; sources state no fix.","how_to_check":"- Check whether the Meetily backend under `backend/app/main.py` is deployed or running on any host you operate.\n- Check the installed Meetily version; the flaw affects versions up to `0.4.1`.\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unified-tauri-app"],"who_is_affected":"The flaw is in the legacy client-server backend of Meetily up to 0.4.1; the vendor has deprecated that architecture in favour of a unified Tauri application, and the vulnerable code is still on main. Teams running the legacy backend reachable from a network are exposed; installs using only the newer unified app are not described as affected by the sources.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000737,"input_tokens":4617,"output_tokens":551,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm which Meetily versions expose backend/app/main.py over the network and whether any fixed version exists; sources state no fix.","search":"'-127286':12A,15A '-2026':11A,14A '0.4.1':72C 'affect':73C 'app':31B 'applic':131C,146C 'architectur':143C 'attack':49B,89C 'authent':7A,46B,87C 'avail':101C 'backend':3A,39B,54B,108C 'backend/app/main.py':41B,81C 'carri':94C 'client':141C 'client-serv':140C 'code':114C 'credenti':60B 'cve':10A,13A 'deprec':138C 'docker':17B 'e':124C 'enforc':45B 'explain':122C 'exploit':98C 'fastapi':18B 'file':40B,80C 'framework':135C 'function':58B,77C 'host':23B 'identifi':64C 'invok':56B 'lack':6A 'lead':84C 'legaci':2A,38B,107C 'main':119C 'main.py':5A 'manipul':83C 'meet':29B 'meetili':1A,19B,24B,69C 'meetily':16A 'might':103C 'miss':86C 'move':126C 'open':27B 'open-sourc':26B 'packag':20B 'possibl':91C 'present':117C 'public':100C 'reach':52B 'reachabl':8A 'remot':9A,48B,96C 'remov':111C 'self':22B 'self-host':21B 'server':142C 'singl':129C 'solut':35B,68C 'sourc':28B 'still':116C 'tauri':134C 'toward':127C 'transcript':30B 'unifi':130C 'unknown':76C 'use':105C,132C 'vendor':121C 'vulner':62C,113C 'w':123C 'without':59B 'yet':112C 'zackriya':34B,67C 'zackriya-solut':33B,66C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host the legacy client-server Meetily backend (backend/app/main.py, versions up to 0.4.1) where its port is reachable from a network. An unauthenticated caller can reach the backend API, which per the #845 reporter includes stored LLM provider API keys and meeting transcripts. Users of only the unified Tauri desktop app, or with the backend bound to localhost, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"pkeys":["meetily"],"ptokens":["meetily"],"labels":["docker","fastapi","high","meetily","package","selfhosted"],"campaign_type":null,"search_a":"'-127286':12A,15A '-2026':11A,14A 'authent':7A 'backend':3A 'cve':10A,13A 'lack':6A 'legaci':2A 'main.py':5A 'meetili':1A 'meetily':16A 'reachabl':8A 'remot':9A","search_b":"'app':31B 'attack':49B 'authent':46B 'backend':39B,54B 'backend/app/main.py':41B 'credenti':60B 'docker':17B 'enforc':45B 'fastapi':18B 'file':40B 'function':58B 'host':23B 'invok':56B 'legaci':38B 'meet':29B 'meetili':19B,24B 'open':27B 'open-sourc':26B 'packag':20B 'reach':52B 'remot':48B 'self':22B 'self-host':21B 'solut':35B 'sourc':28B 'transcript':30B 'without':59B 'zackriya':34B 'zackriya-solut':33B","search_c":"'0.4.1':72C 'affect':73C 'applic':131C,146C 'architectur':143C 'attack':89C 'authent':87C 'avail':101C 'backend':108C 'backend/app/main.py':81C 'carri':94C 'client':141C 'client-serv':140C 'code':114C 'deprec':138C 'e':124C 'explain':122C 'exploit':98C 'file':80C 'framework':135C 'function':77C 'identifi':64C 'lead':84C 'legaci':107C 'main':119C 'manipul':83C 'meetili':69C 'might':103C 'miss':86C 'move':126C 'possibl':91C 'present':117C 'public':100C 'remot':96C 'remov':111C 'server':142C 'singl':129C 'solut':68C 'still':116C 'tauri':134C 'toward':127C 'unifi':130C 'unknown':76C 'use':105C,132C 'vendor':121C 'vulner':62C,113C 'w':123C 'yet':112C 'zackriya':67C 'zackriya-solut':66C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T03:17:30+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-127286","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127286","severity":null,"published_at":"2026-11-13T03:17:30+00:00","modified_at":"2026-11-13T03:17:30+00:00","first_seen_at":"2026-11-13T03:42:55+00:00","fetched_at":"2026-11-13T03:42:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-127286:3813","url":"https://github.com/Zackriya-Solutions/meetily/issues/845","severity":null,"published_at":"2026-11-13T03:45:12+00:00","modified_at":"2026-11-13T03:45:12+00:00","first_seen_at":"2026-11-13T03:45:12+00:00","fetched_at":"2026-11-13T03:45:12+00:00","note":"NVD text plus GitHub issues #845 and #616 read. Maintainer says the client-server backend is deprecated and closed reports as not planned; no fix. Public exploit claimed by NVD but no PoC link found; web-cli unavailable, X not searched. Nothing verified.","cites":["https://github.com/Zackriya-Solutions/meetily/issues/845","https://github.com/Zackriya-Solutions/meetily/issues/616"]}],"documents":[{"id":142465,"url":"https://github.com/Zackriya-Solutions/meetily/issues/845","title":"Meetily #845: Self-hosted backend has no authentication (closed not planned)","kind":"issue","source":"analyst","publisher":null,"text":"Reporter carfeii (2026-10-13): no route in backend/app/main.py checks credentials; binds 0.0.0.0; docker compose publishes port on all interfaces; confirmed against default branch. Collaborator safvanatzack: project moving to unified Tauri app, client-server architecture deprecated, report does not refer to current codebase. Closed not planned. No fix linked.","published_at":null,"relation":"describes","confidence":null,"note":null},{"id":142466,"url":"https://github.com/Zackriya-Solutions/meetily/issues/616","title":"Meetily #616: savemodelconfig endpoint unauthenticated (closed not planned)","kind":"issue","source":"analyst","publisher":null,"text":"Reporter LYNXRAYAI: POST /save-model-config in backend/app/main.py lacks authentication; caller can change model settings and overwrite stored API key. Closed as not planned 2026-07-15 by collaborator; comments only 'Spamming'. No versions listed.","published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}