CVE-2026-49202: Unverified Meeting Recording Endpoints & Permissive CORS

Affected Software

Remediation

Recommended actions to resolve this vulnerability, in priority order.

1. Configuration

   Require authentication and authorization for access to internal multimedia session archives and meeting recording endpoints. Return HTTP 401 for unauthenticated requests and HTTP 403 for unauthorized requests; enforce per-resource ACLs.

   Meeting/Recording endpoints authentication_required = true
2. Configuration

   Replace wildcard or overly permissive CORS origins with an allowlist of specific trusted origins. Validate the Origin header server-side and only echo back origins that are explicitly allowed.

   CORS configuration Access-Control-Allow-Origin = restricted to trusted origins (do not use '*')
3. Configuration

   Disable Access-Control-Allow-Credentials for endpoints serving sensitive media. If credentials are required, ensure Access-Control-Allow-Origin is not '*' and only trusted origins are permitted.

   CORS configuration Access-Control-Allow-Credentials = false unless required and paired with a specific origin
4. Compensating control

   Restrict network access to multimedia archives and recording endpoints via firewall/ACLs or require VPN access; allow management or download access only from trusted IP ranges or internal networks.

5. Operational

   Audit access logs for unauthorized accesses or cross-site theft and revoke or invalidate any public/unprotected recording links or tokens; reissue links only after applying proper authentication and CORS restrictions.

Event History

Frequently Asked Questions