---
id: "CVE-2026-127286"
page: "https://infrastack.ai/live/CVE-2026-127286"
kind: "vulnerability"
aliases: ["CVE-2026-127286"]
title: "Meetily: legacy backend in main.py lacks authentication, reachable remotely"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "meetily", "fixed": [], "affected": "<= 0.4.1", "ecosystem": "github"}]
ecosystems: []
tags: ["docker", "fastapi", "meetily", "package", "self-hosted"]
not_affected_if: ["localhost-only", "unified-tauri-app"]
published_at: "2026-11-13T03:17:30+00:00"
first_seen_at: "2026-11-13T03:42:55+00:00"
updated_at: "2026-11-13T03:45:12+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-127286", "first_seen_at": "2026-11-13T03:42:55+00:00"}, {"source": "analyst", "url": "https://github.com/Zackriya-Solutions/meetily/issues/845", "first_seen_at": "2026-11-13T03:45:12+00:00", "cites": ["https://github.com/Zackriya-Solutions/meetily/issues/845", "https://github.com/Zackriya-Solutions/meetily/issues/616"]}]
exploit_sources: []
---

# Meetily: legacy backend in main.py lacks authentication, reachable remotely

Link for people: https://infrastack.ai/live/CVE-2026-127286 (this .md is for agents)

Meetily, an open-source meeting transcription app by Zackriya-Solutions, has a legacy backend file (backend/app/main.py) that does not enforce authentication. A remote attacker who can reach that backend can invoke its functions without credentials.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- github:meetily affected <= 0.4.1 fixed no fixed version listed

## How to check

- Look for a running legacy Meetily backend: a FastAPI service from backend/app/main.py, or the project's Docker Compose stack publishing its port (reporter says it binds 0.0.0.0 and publishes on all interfaces).
- From another machine, try the backend's port without credentials; any answer from its API routes means it is exposed.
- Meetily installs that only use the unified Tauri desktop app do not run this backend. Whether the code is gone from main is unconfirmed: NVD says it is still present, the maintainer says the report does not refer to the current codebase.
- Workaround (not vendor-stated): bind to 127.0.0.1 or firewall the port.

## Fix

No fix. Maintainers closed the reports as not planned (#845) because the client-server backend is deprecated in favour of the unified Tauri app. Stop running the legacy backend, or keep it off the network.

## Timeline

- 2026-11-13T03:42:55+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-127286
- 2026-11-13T03:45:12+00:00 analyst https://github.com/Zackriya-Solutions/meetily/issues/845 — NVD text plus GitHub issues #845 and #616 read. Maintainer says the client-server backend is deprecated and closed reports as not planned; no fix. Public exploit claimed by NVD but no PoC link found; web-cli unavailable, X not searched. Nothing verified.

## Documents

- [describes] Meetily #845: Self-hosted backend has no authentication (closed not planned) https://github.com/Zackriya-Solutions/meetily/issues/845
- [mentions] Meetily #616: savemodelconfig endpoint unauthenticated (closed not planned) https://github.com/Zackriya-Solutions/meetily/issues/616

## From the sources

A vulnerability was identified in Zackriya-Solutions Meetily up to 0.4.1. Affected is an unknown function of the file backend/app/main.py. The manipulation leads to missing authentication. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The legacy backend was not removed yet. Vulnerable code is still present on main. The vendor explains: "[W]e are moving towards a single unified application using the tauri framework, and we deprecated the client-server architecture of this application."

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_