CVE-2026-0856
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
Improper access control in Meona Client Launcher and Meona Server components allows a normal user to gain access to the admin panel. Affects versions up to 19.06.2020 (Client Launcher) and up to 2025.04 5+323020 (Server).
Risk Assessment
The risk involves privilege escalation from a normal user to administrator level, potentially leading to full system compromise.
Recommendation
Immediately update Meona components to the latest versions available from the vendor.
Other vulnerabilities in Meona
See all- CVE-2026-22314Critical
A code injection vulnerability in Meona Client Launcher and Server components allows code execution on other users' systems. Affects versions up to 19.06.2020 15:11:49 (Client Launcher) and up to 2025.04 5+323020 (Server).
- CVE-2026-25602Medium
Insufficient data authenticity verification in Meona Client Launcher and Meona Server components allows sending messages to any email address.
- CVE-2026-22315High
Vulnerability in the Meona client and server components (Mesalvo) allows export of user data, including cleartext passwords, via the SQL editor. Affects client versions up to 19.06.2020 15:11:49 and server versions up to 2025.04 5+323020.
- CVE-2026-0857Medium
Cleartext storage of sensitive information in memory vulnerability in Meona Client Launcher and Meona Server components. Affects Client Launcher through 19.06.2020 15:11:49 and Server through 2025.04 5+323020.
Original NVD description (English source)
Improper Access Control vulnerability in Mesalvo Meona Client Launcher Component, Mesalvo Meona Server Component enables a normal user gaining access to the admin panel. This issue affects Meona Client Launcher Component: through 19.06.2020 15:11:49; Meona Server Component: through 2025.04 5+323020.