CVE-2026-122327— Meelo through 3.13.1 Missing Authorization on Song, Track and Video Endpoints

Quick assessment

Affected

Arthi-chaud Meelo

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Meelo 3.13.1 及更早版本存在一个缺少授权校验的漏洞。由于在歌曲（song）、音轨（track）和视频（video）的写操作路由中未强制要求管理员权限，已认证的非管理员用户可以修改共享目录数据。攻击者可通过向、或发送 PUT 请求，或向发送 POST 请求，来篡改流派、重新分配音轨以及合并歌曲。

CVSS 4.3 · Medium Updated Nov 05, 2026

Possible ATT&CK Techniques 1 AI

T1068 · Exploitation for Privilege Escalation

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Meelo through 3.13.1 Missing Authorization on Song, Track and Video Endpoints

Source: CVE Program / CVE List V5

Vulnerability Description

Meelo through 3.13.1 contains a missing authorization vulnerability that allows authenticated non-admin users to modify shared catalog data because RolesGuard does not require Admin on song, track and video write routes. Attackers can send PUT requests to /songs/:idOrSlug, /tracks/:idOrSlug or /videos/:idOrSlug, or POST to /songs/:idOrSlug/merge, to alter genres, reassign tracks and merge songs.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制缺失

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Arthi-chaud	Meelo	0 ~ 3.13.1	-

II. Public POCs for CVE-2026-122327

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-122327

请登录查看更多情报信息。

Other References for CVE-2026-122327 (8)

https://github.com/Arthi-chaud/Meelo/blob/v3.13.1/server/src/authentication/roles/roles.guard.ts#L48-L117 technical-description
https://github.com/Arthi-chaud/Meelo/blob/v3.13.1/server/src/track/track.controller.ts#L145-L160 technical-description
https://hackmd.io/@hieund/meelo-catalog-metadata-write-missing-admin-authz third-party-advisory
https://github.com/Arthi-chaud/Meelo product
https://github.com/Arthi-chaud/Meelo/blob/v3.13.1/server/src/song/song.controller.ts#L275-L309 technical-description
https://github.com/Arthi-chaud/Meelo/issues/2185 issue-tracking
https://github.com/Arthi-chaud/Meelo/blob/v3.13.1/server/src/video/video.controller.ts#L131-L149 technical-description
https://www.vulncheck.com/advisories/meelo-through-3.13.1-missing-authorization-on-song-track-and-video-endpoints third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-122327

IV. Related Vulnerabilities

Same weakness: CWE-862