CVE-2026-127286: Zackriya-Solutions Meetily main.py missing authentication
A vulnerability was identified in Zackriya-Solutions Meetily up to 0.4.1. Affected is an unknown function of the file backend/app/main.py. The manipulation leads to missing authentication. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The legacy backend was not removed yet. Vulnerable code is still present on main. The vendor explains: "[W]e are moving towards a single unified application using the tauri framework, and we deprecated the client-server architecture of this application."
Event History
Frequently Asked Questions
Which deployments are exposed?
Meetily versions up to 0.4.1 are affected through an unknown function in backend/app/main.py. The legacy client-server backend has been deprecated but was not removed, and vulnerable code remains on the main branch.
Does exploitation require local access or prior authentication?
The issue can be exploited remotely. The available data identifies it as missing authentication, but does not state any prerequisite account, role, or network-access requirement beyond remote reachability.
How urgent is mitigation?
A public exploit is available and may be used, so deployments with the legacy backend reachable remotely should be treated as exposed until the vulnerable backend code is removed or otherwise remediated.