CVE-2022-34624

MediumCVSS 5.9

Published: 19/08/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.51%

40th percentile - higher than 40% of all known CVEs

Summary

The vulnerability in Mealie 1.0.0beta3 fails to terminate download tokens after a user logs out, allowing attackers to perform a man-in-the-middle attack via a crafted GET request.

Risk Assessment

An attacker can intercept and modify data exchanged between the user and the server, compromising data confidentiality and integrity.

Recommendation

Immediately upgrade Mealie to a version later than 1.0.0beta3 where the issue is fixed. Additionally, implement token invalidation mechanisms upon logout.

Original NVD description (English source)

Mealie1.0.0beta3 does not terminate download tokens after a user logs out, allowing attackers to perform a man-in-the-middle attack via a crafted GET request.