CVE-2026-127286
Deferred Deferred - Pending Action

Missing Authentication in Meetily Legacy Backend

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulDB

Description
A vulnerability was identified in Zackriya-Solutions Meetily up to 0.4.1. Affected is an unknown function of the file backend/app/main.py. The manipulation leads to missing authentication. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The legacy backend was not removed yet. Vulnerable code is still present on main. The vendor explains: "[W]e are moving towards a single unified application using the tauri framework, and we deprecated the client-server architecture of this application."

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-127286
EUVD
EUVD-2026-124832

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Zackriya-Solutions Meetily 0.4.0
Zackriya-Solutions Meetily 0.4.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Meetily application's backend up to version 0.4.1. The issue is in the main.py file where no authentication is required for any endpoint. This allows remote attackers to access all server functions without credentials. The vulnerability exists because the legacy backend was not removed and is still present in the codebase.

Detection Guidance

Check if the Meetily backend is running on all network interfaces (0.0.0.0) by inspecting the Docker Compose configuration or main.py file. Use network scanning tools like nmap to identify open ports and services. Look for unauthenticated API endpoints by sending HTTP requests to the server's IP address.

Impact Analysis

This vulnerability allows unauthorized remote access to the Meetily backend. Attackers could steal stored LLM provider API keys and all meeting transcripts. Since the backend binds to all network interfaces by default, any network client can exploit this issue. The impact includes data breaches and loss of sensitive information.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA requirements for data protection and access controls. It exposes sensitive meeting data and API keys without authentication, failing to meet standards for confidentiality and integrity. Compliance with these regulations requires proper authentication and data protection measures.

Mitigation Strategies

Bind the backend to localhost only instead of 0.0.0.0. Implement authentication for all endpoints. Restrict network access to the server using firewalls. Migrate to the new Tauri-based architecture if possible, as the legacy backend will not be updated.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-127286. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...