CVE-2026-127286

waiting for further signals

GHSA-x2r4-mx29-qfc3 ↗EUVD-2026-124832 ↗

no check availablenot proven exploitable

cve.orgpublic pockev

Zackriya-Solutions Meetily 0.4.0; 0.4.1

ETK-2026-4345, permanent identifier

cvss7.3cna vendorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

3h 18msince last run

21mAI analysis

timeline

0 = cve.org publication

trigger signal (cve.org) +0hwaiting for further signals+2h10m

+4h

+6h

+8h

+10h

+12h

description

Meetily versions through 0.4.1 are affected by missing authentication in the legacy backend. A remote attacker may access affected backend functionality without authentication when the legacy client-server backend is deployed and reachable.

mitigation

Disable or remove the legacy client-server backend and restrict network access to it. No fixed release is identified; do not treat the main branch as remediated.

check

exploit

automation

–

auth required

EPSS

–

agent run time

21m

cve.org record, t = 0

2026-11-13 02:30Z

Δ to public poc

–

Δ to kev

–

outcome

No artifact: an exploit or check was attempted but could not be produced at this moment.

source signals

Public signals that triggered or updated the pipeline. These are inputs for the deltas above.

2026-11-13 02:30Z
ghsa: trigger signal, started the run
https://github.com/advisories/GHSA-x2r4-mx29-qfc3
2026-11-13 02:30Z
cve.org record for CVE-2026-127286
cve_org · https://www.cve.org/CVERecord?id=CVE-2026-127286

this entry in the feed

GET /api/v1/feed/CVE-2026-127286

{
  "etk_id": "ETK-2026-4345",
  "cve_id": "CVE-2026-127286",
  "display_id": "CVE-2026-127286",
  "ghsa_id": "GHSA-x2r4-mx29-qfc3",
  "euvd_id": "EUVD-2026-124832",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Missing authentication in Meetily legacy backend",
  "summary": "Meetily versions through 0.4.1 are affected by missing authentication in the legacy backend. A remote attacker may access affected backend functionality without authentication when the legacy client-server backend is deployed and reachable.",
  "mitigation": "Disable or remove the legacy client-server backend and restrict network access to it. No fixed release is identified; do not treat the main branch as remediated.",
  "vendor": "Zackriya-Solutions",
  "product": "Meetily",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "0.4.0",
        "0.4.1"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Meetily",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 7.3,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 20.5011316,
  "t0_at": "2026-11-13T02:30:30.754000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-13T02:30:30.754000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-13T02:30:30.754000+00:00",
      "url": "https://github.com/advisories/GHSA-x2r4-mx29-qfc3"
    }
  }
}

published 2026-11-13 04:20Z
last change 2026-11-13 07:43Z

Need the technical details behind an entry?

Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.