CVE-2026-0856Published

Improper Access Control vulnerability in Mesalvo MEONA (MEONA Client and MEONA Server) allows an authenticated MEONA user to access administrative functions of the MEONA Client (admin panel). The MEONA Server does not independently verify t…

cve-program · CVE-2026-0856

Published

Meona Client

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "Mesalvo",
                    "product": "Meona Client",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "2024.10",
                            "versionType": "custom"
                        },
                        {
                            "status": "affected",
                            "version": "2025.04",
                            "versionType": "custom"
                        },
                        {
                            "status": "affected",
                            "version": "2026.03",
                            "versionType": "custom"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Meona Server

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "Mesalvo",
                    "product": "Meona Server",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "2024.10",
                            "versionType": "custom"
                        },
                        {
                            "status": "affected",
                            "version": "2025.04",
                            "versionType": "custom"
                        },
                        {
                            "status": "affected",
                            "version": "2026.03",
                            "versionType": "custom"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON