CVE-2026-22315

HIGH

Mesalvo Meona Client Launcher <= 19.06.2020 & Server <= 2025.04 - Unprotected User Data Exposure

Title source: llm
STIX 2.1

Description

Incorrect Privilege Assignment vulnerability in Mesalvo Meona Client Launcher Component, Mesalvo Meona Server Component enables the export  of user data, including cleartext passwords, via the SQL editor. This issue affects Meona Client Launcher Component: through 19.06.2020 15:11:49; Meona Server Component: through 2025.04 5+323020.

References (1)

Core 1
Core References
Third Party Advisory third-party-advisory
https://seccore.at/blog/cves-meona/

Scores

CVSS v3 7.2
EPSS 0.0035
EPSS Percentile 26.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-266
Status published
Products (2)
Mesalvo/Meona Client Launcher Component < 19.06.2020 15:11:49
Mesalvo/Meona Server Component < 2025.04 5+323020
Published May 20, 2026
Tracked Since May 20, 2026