Search
Find a vulnerability
Search criteria
6 vulnerabilities found for Meona Server by Mesalvo
CVE-2026-25602 (GCVE-0-2026-25602)
Vulnerability from nvd – Published: 2026-05-20 10:54 – Updated: 2026-09-25 14:39
VLAI
EPSS
VEX
Summary
Insufficient Verification of Data Authenticity in the feedback function of Mesalvo MEONA (MEONA Client and MEONA Server). The MEONA Client transmits the recipient address of a feedback report to the MEONA Server, and the server sends the report to the transmitted address instead of the address configured on the server. The feedback function is available only in the MEONA administration area, which requires one of the administrative roles ADMINISTRATOR, SUPERADMINISTRATOR or TYPIST (catalogue editing), or the PHARMACIST role holding the PHARMACY_ADMINISTRATOR right, assigned explicitly by the operating hospital's administrators. Such a user who modifies the client request can cause the MEONA Server to send a message with content of the user's choosing, from the sender address configured on the server, to a recipient of the user's choosing, within the limits permitted by the operator's mail relay. The message can be used for social engineering because it appears to originate from an internal hospital system.
Exploitation requires a MEONA account with one of the administrative roles named above and access to the operating hospital's internal network; MEONA is operated exclusively within closed hospital networks without exposure to the public Internet, and where a hospital permits remote access to that network at all, it is only through the hospital's own remote-access infrastructure (e.g. VPN) under the hospital's control. The message contains only the recipient, subject and text entered by the user; no data of other users or patients is disclosed. Mesalvo is not aware of any exploitation outside the reported security test.
This issue affects MEONA Client and MEONA Server in versions 2024.10, 2025.04 (before 2025.04.24) and 2026.03 (before 2026.03.02). MEONA 2025.04.24 and 2026.03.02 (planned Q4 2026) enforce the configured recipient address on the server. Operators can restrict at their mail relay which recipients the MEONA sender address may reach.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-20 11:59 UTC
CWE
- CWE-345 - Insufficient Verification of Data Authenticity
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://mesalvo.com/en/vdp/advisories/msa-2026-005.pdf | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mesalvo | Meona Server |
Affected:
2024.10
(custom)
Affected: 2025.04 , < 2025.04.24 (custom) Affected: 2026.03 , < 2026.03.02 (custom) |
|
| Mesalvo | Meona Client |
Affected:
2024.10
(custom)
Affected: 2025.04 , < 2025.04.24 (custom) Affected: 2026.03 , < 2026.03.02 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-25602",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-20T11:59:55.804011Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-20T12:00:29.697Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Meona Server",
"vendor": "Mesalvo",
"versions": [
{
"status": "affected",
"version": "2024.10",
"versionType": "custom"
},
{
"lessThan": "2025.04.24",
"status": "affected",
"version": "2025.04",
"versionType": "custom"
},
{
"lessThan": "2026.03.02",
"status": "affected",
"version": "2026.03",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Meona Client",
"vendor": "Mesalvo",
"versions": [
{
"status": "affected",
"version": "2024.10",
"versionType": "custom"
},
{
"lessThan": "2025.04.24",
"status": "affected",
"version": "2025.04",
"versionType": "custom"
},
{
"lessThan": "2026.03.02",
"status": "affected",
"version": "2026.03",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Insufficient Verification of Data Authenticity in the feedback function of Mesalvo MEONA (MEONA Client and MEONA Server). The MEONA Client transmits the recipient address of a feedback report to the MEONA Server, and the server sends the report to the transmitted address instead of the address configured on the server. The feedback function is available only in the MEONA administration area, which requires one of the administrative roles ADMINISTRATOR, SUPERADMINISTRATOR or TYPIST (catalogue editing), or the PHARMACIST role holding the PHARMACY_ADMINISTRATOR right, assigned explicitly by the operating hospital\u0027s administrators. Such a user who modifies the client request can cause the MEONA Server to send a message with content of the user\u0027s choosing, from the sender address configured on the server, to a recipient of the user\u0027s choosing, within the limits permitted by the operator\u0027s\u0026nbsp;mail relay. The message can be used for social engineering because it appears to originate from an internal hospital system.\u003cbr\u003eExploitation requires a MEONA account with one of the administrative roles named above and access to the operating hospital\u0027s internal network; MEONA is operated exclusively within closed hospital networks without exposure to the public Internet, and where a hospital permits remote access to that network at all, it is only through the hospital\u0027s own remote-access infrastructure (e.g. VPN) under the hospital\u0027s control. The message contains only the recipient, subject and text entered by the user; no data of other users or patients is disclosed. Mesalvo is not aware of any exploitation outside the reported security test.\u003cbr\u003eThis issue affects MEONA Client and MEONA Server in versions 2024.10, 2025.04 (before 2025.04.24) and 2026.03 (before 2026.03.02). MEONA 2025.04.24 and 2026.03.02 (planned Q4 2026) enforce the configured recipient address on the server. Operators can restrict at their mail relay which recipients the MEONA sender address may reach."
}
],
"value": "Insufficient Verification of Data Authenticity in the feedback function of Mesalvo MEONA (MEONA Client and MEONA Server). The MEONA Client transmits the recipient address of a feedback report to the MEONA Server, and the server sends the report to the transmitted address instead of the address configured on the server. The feedback function is available only in the MEONA administration area, which requires one of the administrative roles ADMINISTRATOR, SUPERADMINISTRATOR or TYPIST (catalogue editing), or the PHARMACIST role holding the PHARMACY_ADMINISTRATOR right, assigned explicitly by the operating hospital\u0027s administrators. Such a user who modifies the client request can cause the MEONA Server to send a message with content of the user\u0027s choosing, from the sender address configured on the server, to a recipient of the user\u0027s choosing, within the limits permitted by the operator\u0027s\u00a0mail relay. The message can be used for social engineering because it appears to originate from an internal hospital system.\nExploitation requires a MEONA account with one of the administrative roles named above and access to the operating hospital\u0027s internal network; MEONA is operated exclusively within closed hospital networks without exposure to the public Internet, and where a hospital permits remote access to that network at all, it is only through the hospital\u0027s own remote-access infrastructure (e.g. VPN) under the hospital\u0027s control. The message contains only the recipient, subject and text entered by the user; no data of other users or patients is disclosed. Mesalvo is not aware of any exploitation outside the reported security test.\nThis issue affects MEONA Client and MEONA Server in versions 2024.10, 2025.04 (before 2025.04.24) and 2026.03 (before 2026.03.02). MEONA 2025.04.24 and 2026.03.02 (planned Q4 2026) enforce the configured recipient address on the server. Operators can restrict at their mail relay which recipients the MEONA sender address may reach."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 2.3,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-345",
"description": "CWE-345: Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T14:39:41.572Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://mesalvo.com/en/vdp/advisories/msa-2026-005.pdf"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "MEONA 2025.04.24 and 2026.03.02 (planned Q4 2026) enforce the configured recipient address on the MEONA Server and ignore any client-supplied recipient."
}
],
"value": "MEONA 2025.04.24 and 2026.03.02 (planned Q4 2026) enforce the configured recipient address on the MEONA Server and ignore any client-supplied recipient."
}
],
"source": {
"discovery": "UNKNOWN"
},
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Operators can restrict, at their mail relay, the recipients that the MEONA sender address (e.g. noreply-meona-\u2026) may reach to the configured feedback mailbox, or to internal domains, and monitor messages from that sender address to other recipients. Details: Mesalvo Security Advisory MSA-2026-005."
}
],
"value": "Operators can restrict, at their mail relay, the recipients that the MEONA sender address (e.g. noreply-meona-\u2026) may reach to the configured feedback mailbox, or to internal domains, and monitor messages from that sender address to other recipients. Details: Mesalvo Security Advisory MSA-2026-005."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-25602",
"datePublished": "2026-05-20T10:54:13.448Z",
"dateReserved": "2026-02-03T07:24:49.548Z",
"dateUpdated": "2026-09-25T14:39:41.572Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-0857 (GCVE-0-2026-0857)
Vulnerability from nvd – Published: 2026-05-20 10:50 – Updated: 2026-09-25 14:23
VLAI
EPSS
VEX
Summary
Use of a Password Hash With Insufficient Computational Effort in Mesalvo MEONA (MEONA Server and MEONA Client) for user accounts whose password was last set under a version before MEONA 2024.10. MEONA versions before 2024.10 protected stored passwords with SHA-1 (versions from October 2015) or stored them without protection (earlier versions). Since MEONA 2024.10 (June 2024) Argon2 is the default method and every password that is set or changed is stored with Argon2; passwords last set under an earlier version keep the earlier method until they are changed. An administrator could in addition select the storage method per account. A MEONA super administrator can read the stored value of such accounts in the user administration of the MEONA Client or export it through administrative database functions. Only accounts managed locally in MEONA are affected; accounts authenticated through the operating hospital's directory service (Active Directory / Entra ID) have no password stored in MEONA. In typical installations end users authenticate through the directory service and local accounts are limited to emergency and technical accounts.
Exploitation requires super administrator permissions in MEONA (or direct access to the MEONA database) from within the operating hospital's network; MEONA is operated exclusively within closed hospital networks without exposure to the public Internet, and where a hospital permits remote access to that network at all, it is only through the hospital's own remote-access infrastructure (e.g. VPN) under the hospital's control. Installations in which every password has been set or changed under MEONA 2024.10 or later are not affected. Mesalvo is not aware of any exploitation outside the reported security test.
This issue affects MEONA Server and MEONA Client in versions 2024.10, 2025.04 and 2026.03 (for accounts with passwords last set under earlier versions). MEONA 2025.04.24 and 2026.03.02 (planned Q4 2026) remove the legacy storage methods, require every affected account to set a new Argon2-protected password at next logon, and no longer display stored credential values in the user administration. See Mesalvo Security Advisory MSA-2026-002.
Severity
4.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-20 12:01 UTC
CWE
- CWE-916 - Use of password hash with insufficient computational effort
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://mesalvo.com/en/vdp/advisories/msa-2026-002.pdf | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mesalvo | Meona Client |
Affected:
2024.10
(custom)
Affected: 2025.04 , < 2025.04.24 (custom) Affected: 2026.03 , < 2026.03.02 (custom) |
|
| Mesalvo | Meona Server |
Affected:
2024.10
(custom)
Affected: 2025.04 , < 2025.04.24 (custom) Affected: 2026.03 , < 2026.03.02 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-0857",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-20T12:01:24.904395Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-20T12:01:48.193Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Meona Client",
"vendor": "Mesalvo",
"versions": [
{
"status": "affected",
"version": "2024.10",
"versionType": "custom"
},
{
"lessThan": "2025.04.24",
"status": "affected",
"version": "2025.04",
"versionType": "custom"
},
{
"lessThan": "2026.03.02",
"status": "affected",
"version": "2026.03",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Meona Server",
"vendor": "Mesalvo",
"versions": [
{
"status": "affected",
"version": "2024.10",
"versionType": "custom"
},
{
"lessThan": "2025.04.24",
"status": "affected",
"version": "2025.04",
"versionType": "custom"
},
{
"lessThan": "2026.03.02",
"status": "affected",
"version": "2026.03",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Use of a Password Hash With Insufficient Computational Effort in Mesalvo MEONA (MEONA Server and MEONA Client) for user accounts whose password was last set under a version before MEONA 2024.10. MEONA versions before 2024.10 protected stored passwords with SHA-1 (versions from October\u0026nbsp;2015) or stored them without protection (earlier versions). Since MEONA 2024.10 (June 2024) Argon2 is the default method and every password that is set or changed is stored with Argon2; passwords last set under an earlier version keep the earlier method until they are changed. An administrator could in addition select the storage method per account. A MEONA super administrator can read the stored value of such accounts in the user administration of the MEONA Client or export it through administrative database functions. Only accounts managed locally in MEONA are affected; accounts authenticated through the operating hospital\u0027s directory service (Active Directory / Entra ID) have no password stored in MEONA. In typical installations end users authenticate through the directory service and local accounts are limited to emergency and technical accounts.\u003cbr\u003eExploitation requires super administrator permissions in MEONA (or direct access to the MEONA database) from within the operating hospital\u0027s network; MEONA is operated exclusively within closed hospital networks without exposure to the public Internet, and where a hospital permits remote access to that network at all, it is only through the hospital\u0027s own remote-access infrastructure (e.g. VPN) under the hospital\u0027s control. Installations in which every password has been set or changed under MEONA 2024.10 or later are not affected. Mesalvo is not aware of any exploitation outside the reported security test.\u003cbr\u003eThis issue affects MEONA Server and MEONA Client in versions 2024.10, 2025.04 and 2026.03 (for accounts with passwords last set under earlier versions). MEONA 2025.04.24 and 2026.03.02 (planned Q4 2026) remove the legacy storage methods, require every affected account to set a new Argon2-protected password at next logon, and no longer display stored credential values in the user administration. See Mesalvo Security Advisory MSA-2026-002."
}
],
"value": "Use of a Password Hash With Insufficient Computational Effort in Mesalvo MEONA (MEONA Server and MEONA Client) for user accounts whose password was last set under a version before MEONA 2024.10. MEONA versions before 2024.10 protected stored passwords with SHA-1 (versions from October\u00a02015) or stored them without protection (earlier versions). Since MEONA 2024.10 (June 2024) Argon2 is the default method and every password that is set or changed is stored with Argon2; passwords last set under an earlier version keep the earlier method until they are changed. An administrator could in addition select the storage method per account. A MEONA super administrator can read the stored value of such accounts in the user administration of the MEONA Client or export it through administrative database functions. Only accounts managed locally in MEONA are affected; accounts authenticated through the operating hospital\u0027s directory service (Active Directory / Entra ID) have no password stored in MEONA. In typical installations end users authenticate through the directory service and local accounts are limited to emergency and technical accounts.\nExploitation requires super administrator permissions in MEONA (or direct access to the MEONA database) from within the operating hospital\u0027s network; MEONA is operated exclusively within closed hospital networks without exposure to the public Internet, and where a hospital permits remote access to that network at all, it is only through the hospital\u0027s own remote-access infrastructure (e.g. VPN) under the hospital\u0027s control. Installations in which every password has been set or changed under MEONA 2024.10 or later are not affected. Mesalvo is not aware of any exploitation outside the reported security test.\nThis issue affects MEONA Server and MEONA Client in versions 2024.10, 2025.04 and 2026.03 (for accounts with passwords last set under earlier versions). MEONA 2025.04.24 and 2026.03.02 (planned Q4 2026) remove the legacy storage methods, require every affected account to set a new Argon2-protected password at next logon, and no longer display stored credential values in the user administration. See Mesalvo Security Advisory MSA-2026-002."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-916",
"description": "CWE-916 Use of password hash with insufficient computational effort",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T14:23:59.996Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://mesalvo.com/en/vdp/advisories/msa-2026-002.pdf"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "MEONA 2025.04.24 and 2026.03.02 (Q4 2026) remove the legacy password storage methods, require every account whose password is still stored with a legacy method to set a new Argon2-protected password at next logon, and remove the display of stored credential values from the user administration."
}
],
"value": "MEONA 2025.04.24 and 2026.03.02 (Q4 2026) remove the legacy password storage methods, require every account whose password is still stored with a legacy method to set a new Argon2-protected password at next logon, and remove the display of stored credential values from the user administration."
}
],
"source": {
"discovery": "UNKNOWN"
},
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Until the service packs are installed, administrators can force a password change for accounts whose password was last set under a version before MEONA 2024.10; the new password is stored with Argon2.\u0026nbsp;\u003cbr\u003e\u003cbr\u003eInstallations in which every password has been set or changed under MEONA 2024.10 or later are not affected. Details: Mesalvo Security Advisory MSA-2026-002."
}
],
"value": "Until the service packs are installed, administrators can force a password change for accounts whose password was last set under a version before MEONA 2024.10; the new password is stored with Argon2.\u00a0\n\nInstallations in which every password has been set or changed under MEONA 2024.10 or later are not affected. Details: Mesalvo Security Advisory MSA-2026-002."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-0857",
"datePublished": "2026-05-20T10:50:58.695Z",
"dateReserved": "2026-01-12T06:14:14.665Z",
"dateUpdated": "2026-09-25T14:23:59.996Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-0856 (GCVE-0-2026-0856)
Vulnerability from nvd – Published: 2026-05-20 10:38 – Updated: 2026-09-25 15:44
VLAI
EPSS
VEX
Summary
Improper Access Control vulnerability in Mesalvo MEONA (MEONA Client and MEONA Server) allows an authenticated MEONA user to access administrative functions of the MEONA Client (admin panel). The MEONA Server does not independently verify the role asserted by the MEONA Client. A user who holds a valid MEONA user account and is able to execute a modified copy of the MEONA Client on a device within the operating hospital's network can assert an administrator role and access administrative functions with regular user credentials.
Exploitation requires: (1) a valid MEONA user account issued by the operating hospital; (2) network access to the MEONA Server, which is operated exclusively within closed hospital networks without exposure to the public Internet (where a hospital permits remote access to that network at all, it is only through the hospital's own remote-access infrastructure (e.g. VPN) under the hospital's control); (3) the ability to modify MEONA Client binaries and to execute the modified copy on a device in that network. On managed devices with application control, as recommended in Mesalvo's hardening guidance (MSA-2026-001), this requires local administrator privileges on the device. Mesalvo is not aware of any exploitation outside the reported security test.
This issue affects MEONA Client and MEONA Server in versions 2024.10, 2025.04 and 2026.03. Mitigations are available with MEONA 2025.04.24 and 2026.03.02 (planned Q4 2026); see Mesalvo Security Advisory MSA-2026-001.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-20 12:27 UTC
CWE
- CWE-284 - Improper Access Control
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://mesalvo.com/en/vdp/advisories/msa-2026-001.pdf | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mesalvo | Meona Client |
Affected:
2024.10
(custom)
Affected: 2025.04 (custom) Affected: 2026.03 (custom) |
|
| Mesalvo | Meona Server |
Affected:
2024.10
(custom)
Affected: 2025.04 (custom) Affected: 2026.03 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-0856",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-20T12:27:02.745163Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-20T12:27:12.637Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Meona Client",
"vendor": "Mesalvo",
"versions": [
{
"status": "affected",
"version": "2024.10",
"versionType": "custom"
},
{
"status": "affected",
"version": "2025.04",
"versionType": "custom"
},
{
"status": "affected",
"version": "2026.03",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Meona Server",
"vendor": "Mesalvo",
"versions": [
{
"status": "affected",
"version": "2024.10",
"versionType": "custom"
},
{
"status": "affected",
"version": "2025.04",
"versionType": "custom"
},
{
"status": "affected",
"version": "2026.03",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Access Control vulnerability in Mesalvo MEONA (MEONA Client and MEONA Server) allows an authenticated MEONA user to access administrative functions of the MEONA Client (admin panel). The MEONA Server does not independently verify the role asserted by the MEONA Client. A user who holds a valid MEONA user account and is able to execute a modified copy of the MEONA Client on a device within the operating hospital\u0027s network can assert an administrator role and access administrative functions with regular user credentials.\u003cbr\u003eExploitation requires: (1) a valid MEONA user account issued by the operating hospital; (2) network access to the MEONA Server, which is operated exclusively within closed hospital networks without exposure to the public Internet (where a hospital permits remote access to that network at all, it is only through the hospital\u0027s own remote-access infrastructure (e.g. VPN) under the hospital\u0027s control); (3) the ability to modify MEONA Client binaries and to execute the modified copy on a device in that network. On managed devices with application control, as recommended in Mesalvo\u0027s hardening guidance (MSA-2026-001), this requires local administrator privileges on the device. Mesalvo is not aware of any exploitation outside the reported security test.\u003cbr\u003eThis issue affects MEONA Client and MEONA Server in versions 2024.10, 2025.04 and 2026.03. Mitigations are available with MEONA 2025.04.24 and 2026.03.02 (planned Q4 2026); see Mesalvo Security Advisory MSA-2026-001."
}
],
"value": "Improper Access Control vulnerability in Mesalvo MEONA (MEONA Client and MEONA Server) allows an authenticated MEONA user to access administrative functions of the MEONA Client (admin panel). The MEONA Server does not independently verify the role asserted by the MEONA Client. A user who holds a valid MEONA user account and is able to execute a modified copy of the MEONA Client on a device within the operating hospital\u0027s network can assert an administrator role and access administrative functions with regular user credentials.\nExploitation requires: (1) a valid MEONA user account issued by the operating hospital; (2) network access to the MEONA Server, which is operated exclusively within closed hospital networks without exposure to the public Internet (where a hospital permits remote access to that network at all, it is only through the hospital\u0027s own remote-access infrastructure (e.g. VPN) under the hospital\u0027s control); (3) the ability to modify MEONA Client binaries and to execute the modified copy on a device in that network. On managed devices with application control, as recommended in Mesalvo\u0027s hardening guidance (MSA-2026-001), this requires local administrator privileges on the device. Mesalvo is not aware of any exploitation outside the reported security test.\nThis issue affects MEONA Client and MEONA Server in versions 2024.10, 2025.04 and 2026.03. Mitigations are available with MEONA 2025.04.24 and 2026.03.02 (planned Q4 2026); see Mesalvo Security Advisory MSA-2026-001."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284: Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T15:44:21.119Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://mesalvo.com/en/vdp/advisories/msa-2026-001.pdf"
}
],
"source": {
"discovery": "UNKNOWN"
},
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "MEONA 2025.04.24 and 2026.03.02 (Q4 2026) introduce code signing of all MEONA Client executables and assemblies and integrity verification of the client assemblies at start-up. Operators should enforce application control on MEONA workstations so that only Mesalvo-signed binaries execute, withhold local administrator rights from clinical users, provision MEONA users through the hospital\u0027s central identity and access management, and keep the MEONA network zone segmented without Internet exposure. Details: Mesalvo Security Advisory MSA-2026-001."
}
],
"value": "MEONA 2025.04.24 and 2026.03.02 (Q4 2026) introduce code signing of all MEONA Client executables and assemblies and integrity verification of the client assemblies at start-up. Operators should enforce application control on MEONA workstations so that only Mesalvo-signed binaries execute, withhold local administrator rights from clinical users, provision MEONA users through the hospital\u0027s central identity and access management, and keep the MEONA network zone segmented without Internet exposure. Details: Mesalvo Security Advisory MSA-2026-001."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-0856",
"datePublished": "2026-05-20T10:38:53.881Z",
"dateReserved": "2026-01-12T06:14:09.204Z",
"dateUpdated": "2026-09-25T15:44:21.119Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-25602 (GCVE-0-2026-25602)
Vulnerability from cvelistv5 – Published: 2026-05-20 10:54 – Updated: 2026-09-25 14:39
VLAI
EPSS
VEX
Summary
Insufficient Verification of Data Authenticity in the feedback function of Mesalvo MEONA (MEONA Client and MEONA Server). The MEONA Client transmits the recipient address of a feedback report to the MEONA Server, and the server sends the report to the transmitted address instead of the address configured on the server. The feedback function is available only in the MEONA administration area, which requires one of the administrative roles ADMINISTRATOR, SUPERADMINISTRATOR or TYPIST (catalogue editing), or the PHARMACIST role holding the PHARMACY_ADMINISTRATOR right, assigned explicitly by the operating hospital's administrators. Such a user who modifies the client request can cause the MEONA Server to send a message with content of the user's choosing, from the sender address configured on the server, to a recipient of the user's choosing, within the limits permitted by the operator's mail relay. The message can be used for social engineering because it appears to originate from an internal hospital system.
Exploitation requires a MEONA account with one of the administrative roles named above and access to the operating hospital's internal network; MEONA is operated exclusively within closed hospital networks without exposure to the public Internet, and where a hospital permits remote access to that network at all, it is only through the hospital's own remote-access infrastructure (e.g. VPN) under the hospital's control. The message contains only the recipient, subject and text entered by the user; no data of other users or patients is disclosed. Mesalvo is not aware of any exploitation outside the reported security test.
This issue affects MEONA Client and MEONA Server in versions 2024.10, 2025.04 (before 2025.04.24) and 2026.03 (before 2026.03.02). MEONA 2025.04.24 and 2026.03.02 (planned Q4 2026) enforce the configured recipient address on the server. Operators can restrict at their mail relay which recipients the MEONA sender address may reach.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-20 11:59 UTC
CWE
- CWE-345 - Insufficient Verification of Data Authenticity
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://mesalvo.com/en/vdp/advisories/msa-2026-005.pdf | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mesalvo | Meona Server |
Affected:
2024.10
(custom)
Affected: 2025.04 , < 2025.04.24 (custom) Affected: 2026.03 , < 2026.03.02 (custom) |
|
| Mesalvo | Meona Client |
Affected:
2024.10
(custom)
Affected: 2025.04 , < 2025.04.24 (custom) Affected: 2026.03 , < 2026.03.02 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-25602",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-20T11:59:55.804011Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-20T12:00:29.697Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Meona Server",
"vendor": "Mesalvo",
"versions": [
{
"status": "affected",
"version": "2024.10",
"versionType": "custom"
},
{
"lessThan": "2025.04.24",
"status": "affected",
"version": "2025.04",
"versionType": "custom"
},
{
"lessThan": "2026.03.02",
"status": "affected",
"version": "2026.03",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Meona Client",
"vendor": "Mesalvo",
"versions": [
{
"status": "affected",
"version": "2024.10",
"versionType": "custom"
},
{
"lessThan": "2025.04.24",
"status": "affected",
"version": "2025.04",
"versionType": "custom"
},
{
"lessThan": "2026.03.02",
"status": "affected",
"version": "2026.03",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Insufficient Verification of Data Authenticity in the feedback function of Mesalvo MEONA (MEONA Client and MEONA Server). The MEONA Client transmits the recipient address of a feedback report to the MEONA Server, and the server sends the report to the transmitted address instead of the address configured on the server. The feedback function is available only in the MEONA administration area, which requires one of the administrative roles ADMINISTRATOR, SUPERADMINISTRATOR or TYPIST (catalogue editing), or the PHARMACIST role holding the PHARMACY_ADMINISTRATOR right, assigned explicitly by the operating hospital\u0027s administrators. Such a user who modifies the client request can cause the MEONA Server to send a message with content of the user\u0027s choosing, from the sender address configured on the server, to a recipient of the user\u0027s choosing, within the limits permitted by the operator\u0027s\u0026nbsp;mail relay. The message can be used for social engineering because it appears to originate from an internal hospital system.\u003cbr\u003eExploitation requires a MEONA account with one of the administrative roles named above and access to the operating hospital\u0027s internal network; MEONA is operated exclusively within closed hospital networks without exposure to the public Internet, and where a hospital permits remote access to that network at all, it is only through the hospital\u0027s own remote-access infrastructure (e.g. VPN) under the hospital\u0027s control. The message contains only the recipient, subject and text entered by the user; no data of other users or patients is disclosed. Mesalvo is not aware of any exploitation outside the reported security test.\u003cbr\u003eThis issue affects MEONA Client and MEONA Server in versions 2024.10, 2025.04 (before 2025.04.24) and 2026.03 (before 2026.03.02). MEONA 2025.04.24 and 2026.03.02 (planned Q4 2026) enforce the configured recipient address on the server. Operators can restrict at their mail relay which recipients the MEONA sender address may reach."
}
],
"value": "Insufficient Verification of Data Authenticity in the feedback function of Mesalvo MEONA (MEONA Client and MEONA Server). The MEONA Client transmits the recipient address of a feedback report to the MEONA Server, and the server sends the report to the transmitted address instead of the address configured on the server. The feedback function is available only in the MEONA administration area, which requires one of the administrative roles ADMINISTRATOR, SUPERADMINISTRATOR or TYPIST (catalogue editing), or the PHARMACIST role holding the PHARMACY_ADMINISTRATOR right, assigned explicitly by the operating hospital\u0027s administrators. Such a user who modifies the client request can cause the MEONA Server to send a message with content of the user\u0027s choosing, from the sender address configured on the server, to a recipient of the user\u0027s choosing, within the limits permitted by the operator\u0027s\u00a0mail relay. The message can be used for social engineering because it appears to originate from an internal hospital system.\nExploitation requires a MEONA account with one of the administrative roles named above and access to the operating hospital\u0027s internal network; MEONA is operated exclusively within closed hospital networks without exposure to the public Internet, and where a hospital permits remote access to that network at all, it is only through the hospital\u0027s own remote-access infrastructure (e.g. VPN) under the hospital\u0027s control. The message contains only the recipient, subject and text entered by the user; no data of other users or patients is disclosed. Mesalvo is not aware of any exploitation outside the reported security test.\nThis issue affects MEONA Client and MEONA Server in versions 2024.10, 2025.04 (before 2025.04.24) and 2026.03 (before 2026.03.02). MEONA 2025.04.24 and 2026.03.02 (planned Q4 2026) enforce the configured recipient address on the server. Operators can restrict at their mail relay which recipients the MEONA sender address may reach."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 2.3,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-345",
"description": "CWE-345: Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T14:39:41.572Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://mesalvo.com/en/vdp/advisories/msa-2026-005.pdf"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "MEONA 2025.04.24 and 2026.03.02 (planned Q4 2026) enforce the configured recipient address on the MEONA Server and ignore any client-supplied recipient."
}
],
"value": "MEONA 2025.04.24 and 2026.03.02 (planned Q4 2026) enforce the configured recipient address on the MEONA Server and ignore any client-supplied recipient."
}
],
"source": {
"discovery": "UNKNOWN"
},
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Operators can restrict, at their mail relay, the recipients that the MEONA sender address (e.g. noreply-meona-\u2026) may reach to the configured feedback mailbox, or to internal domains, and monitor messages from that sender address to other recipients. Details: Mesalvo Security Advisory MSA-2026-005."
}
],
"value": "Operators can restrict, at their mail relay, the recipients that the MEONA sender address (e.g. noreply-meona-\u2026) may reach to the configured feedback mailbox, or to internal domains, and monitor messages from that sender address to other recipients. Details: Mesalvo Security Advisory MSA-2026-005."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-25602",
"datePublished": "2026-05-20T10:54:13.448Z",
"dateReserved": "2026-02-03T07:24:49.548Z",
"dateUpdated": "2026-09-25T14:39:41.572Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-0857 (GCVE-0-2026-0857)
Vulnerability from cvelistv5 – Published: 2026-05-20 10:50 – Updated: 2026-09-25 14:23
VLAI
EPSS
VEX
Summary
Use of a Password Hash With Insufficient Computational Effort in Mesalvo MEONA (MEONA Server and MEONA Client) for user accounts whose password was last set under a version before MEONA 2024.10. MEONA versions before 2024.10 protected stored passwords with SHA-1 (versions from October 2015) or stored them without protection (earlier versions). Since MEONA 2024.10 (June 2024) Argon2 is the default method and every password that is set or changed is stored with Argon2; passwords last set under an earlier version keep the earlier method until they are changed. An administrator could in addition select the storage method per account. A MEONA super administrator can read the stored value of such accounts in the user administration of the MEONA Client or export it through administrative database functions. Only accounts managed locally in MEONA are affected; accounts authenticated through the operating hospital's directory service (Active Directory / Entra ID) have no password stored in MEONA. In typical installations end users authenticate through the directory service and local accounts are limited to emergency and technical accounts.
Exploitation requires super administrator permissions in MEONA (or direct access to the MEONA database) from within the operating hospital's network; MEONA is operated exclusively within closed hospital networks without exposure to the public Internet, and where a hospital permits remote access to that network at all, it is only through the hospital's own remote-access infrastructure (e.g. VPN) under the hospital's control. Installations in which every password has been set or changed under MEONA 2024.10 or later are not affected. Mesalvo is not aware of any exploitation outside the reported security test.
This issue affects MEONA Server and MEONA Client in versions 2024.10, 2025.04 and 2026.03 (for accounts with passwords last set under earlier versions). MEONA 2025.04.24 and 2026.03.02 (planned Q4 2026) remove the legacy storage methods, require every affected account to set a new Argon2-protected password at next logon, and no longer display stored credential values in the user administration. See Mesalvo Security Advisory MSA-2026-002.
Severity
4.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-20 12:01 UTC
CWE
- CWE-916 - Use of password hash with insufficient computational effort
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://mesalvo.com/en/vdp/advisories/msa-2026-002.pdf | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mesalvo | Meona Client |
Affected:
2024.10
(custom)
Affected: 2025.04 , < 2025.04.24 (custom) Affected: 2026.03 , < 2026.03.02 (custom) |
|
| Mesalvo | Meona Server |
Affected:
2024.10
(custom)
Affected: 2025.04 , < 2025.04.24 (custom) Affected: 2026.03 , < 2026.03.02 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-0857",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-20T12:01:24.904395Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-20T12:01:48.193Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Meona Client",
"vendor": "Mesalvo",
"versions": [
{
"status": "affected",
"version": "2024.10",
"versionType": "custom"
},
{
"lessThan": "2025.04.24",
"status": "affected",
"version": "2025.04",
"versionType": "custom"
},
{
"lessThan": "2026.03.02",
"status": "affected",
"version": "2026.03",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Meona Server",
"vendor": "Mesalvo",
"versions": [
{
"status": "affected",
"version": "2024.10",
"versionType": "custom"
},
{
"lessThan": "2025.04.24",
"status": "affected",
"version": "2025.04",
"versionType": "custom"
},
{
"lessThan": "2026.03.02",
"status": "affected",
"version": "2026.03",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Use of a Password Hash With Insufficient Computational Effort in Mesalvo MEONA (MEONA Server and MEONA Client) for user accounts whose password was last set under a version before MEONA 2024.10. MEONA versions before 2024.10 protected stored passwords with SHA-1 (versions from October\u0026nbsp;2015) or stored them without protection (earlier versions). Since MEONA 2024.10 (June 2024) Argon2 is the default method and every password that is set or changed is stored with Argon2; passwords last set under an earlier version keep the earlier method until they are changed. An administrator could in addition select the storage method per account. A MEONA super administrator can read the stored value of such accounts in the user administration of the MEONA Client or export it through administrative database functions. Only accounts managed locally in MEONA are affected; accounts authenticated through the operating hospital\u0027s directory service (Active Directory / Entra ID) have no password stored in MEONA. In typical installations end users authenticate through the directory service and local accounts are limited to emergency and technical accounts.\u003cbr\u003eExploitation requires super administrator permissions in MEONA (or direct access to the MEONA database) from within the operating hospital\u0027s network; MEONA is operated exclusively within closed hospital networks without exposure to the public Internet, and where a hospital permits remote access to that network at all, it is only through the hospital\u0027s own remote-access infrastructure (e.g. VPN) under the hospital\u0027s control. Installations in which every password has been set or changed under MEONA 2024.10 or later are not affected. Mesalvo is not aware of any exploitation outside the reported security test.\u003cbr\u003eThis issue affects MEONA Server and MEONA Client in versions 2024.10, 2025.04 and 2026.03 (for accounts with passwords last set under earlier versions). MEONA 2025.04.24 and 2026.03.02 (planned Q4 2026) remove the legacy storage methods, require every affected account to set a new Argon2-protected password at next logon, and no longer display stored credential values in the user administration. See Mesalvo Security Advisory MSA-2026-002."
}
],
"value": "Use of a Password Hash With Insufficient Computational Effort in Mesalvo MEONA (MEONA Server and MEONA Client) for user accounts whose password was last set under a version before MEONA 2024.10. MEONA versions before 2024.10 protected stored passwords with SHA-1 (versions from October\u00a02015) or stored them without protection (earlier versions). Since MEONA 2024.10 (June 2024) Argon2 is the default method and every password that is set or changed is stored with Argon2; passwords last set under an earlier version keep the earlier method until they are changed. An administrator could in addition select the storage method per account. A MEONA super administrator can read the stored value of such accounts in the user administration of the MEONA Client or export it through administrative database functions. Only accounts managed locally in MEONA are affected; accounts authenticated through the operating hospital\u0027s directory service (Active Directory / Entra ID) have no password stored in MEONA. In typical installations end users authenticate through the directory service and local accounts are limited to emergency and technical accounts.\nExploitation requires super administrator permissions in MEONA (or direct access to the MEONA database) from within the operating hospital\u0027s network; MEONA is operated exclusively within closed hospital networks without exposure to the public Internet, and where a hospital permits remote access to that network at all, it is only through the hospital\u0027s own remote-access infrastructure (e.g. VPN) under the hospital\u0027s control. Installations in which every password has been set or changed under MEONA 2024.10 or later are not affected. Mesalvo is not aware of any exploitation outside the reported security test.\nThis issue affects MEONA Server and MEONA Client in versions 2024.10, 2025.04 and 2026.03 (for accounts with passwords last set under earlier versions). MEONA 2025.04.24 and 2026.03.02 (planned Q4 2026) remove the legacy storage methods, require every affected account to set a new Argon2-protected password at next logon, and no longer display stored credential values in the user administration. See Mesalvo Security Advisory MSA-2026-002."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-916",
"description": "CWE-916 Use of password hash with insufficient computational effort",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T14:23:59.996Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://mesalvo.com/en/vdp/advisories/msa-2026-002.pdf"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "MEONA 2025.04.24 and 2026.03.02 (Q4 2026) remove the legacy password storage methods, require every account whose password is still stored with a legacy method to set a new Argon2-protected password at next logon, and remove the display of stored credential values from the user administration."
}
],
"value": "MEONA 2025.04.24 and 2026.03.02 (Q4 2026) remove the legacy password storage methods, require every account whose password is still stored with a legacy method to set a new Argon2-protected password at next logon, and remove the display of stored credential values from the user administration."
}
],
"source": {
"discovery": "UNKNOWN"
},
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Until the service packs are installed, administrators can force a password change for accounts whose password was last set under a version before MEONA 2024.10; the new password is stored with Argon2.\u0026nbsp;\u003cbr\u003e\u003cbr\u003eInstallations in which every password has been set or changed under MEONA 2024.10 or later are not affected. Details: Mesalvo Security Advisory MSA-2026-002."
}
],
"value": "Until the service packs are installed, administrators can force a password change for accounts whose password was last set under a version before MEONA 2024.10; the new password is stored with Argon2.\u00a0\n\nInstallations in which every password has been set or changed under MEONA 2024.10 or later are not affected. Details: Mesalvo Security Advisory MSA-2026-002."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-0857",
"datePublished": "2026-05-20T10:50:58.695Z",
"dateReserved": "2026-01-12T06:14:14.665Z",
"dateUpdated": "2026-09-25T14:23:59.996Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-0856 (GCVE-0-2026-0856)
Vulnerability from cvelistv5 – Published: 2026-05-20 10:38 – Updated: 2026-09-25 15:44
VLAI
EPSS
VEX
Summary
Improper Access Control vulnerability in Mesalvo MEONA (MEONA Client and MEONA Server) allows an authenticated MEONA user to access administrative functions of the MEONA Client (admin panel). The MEONA Server does not independently verify the role asserted by the MEONA Client. A user who holds a valid MEONA user account and is able to execute a modified copy of the MEONA Client on a device within the operating hospital's network can assert an administrator role and access administrative functions with regular user credentials.
Exploitation requires: (1) a valid MEONA user account issued by the operating hospital; (2) network access to the MEONA Server, which is operated exclusively within closed hospital networks without exposure to the public Internet (where a hospital permits remote access to that network at all, it is only through the hospital's own remote-access infrastructure (e.g. VPN) under the hospital's control); (3) the ability to modify MEONA Client binaries and to execute the modified copy on a device in that network. On managed devices with application control, as recommended in Mesalvo's hardening guidance (MSA-2026-001), this requires local administrator privileges on the device. Mesalvo is not aware of any exploitation outside the reported security test.
This issue affects MEONA Client and MEONA Server in versions 2024.10, 2025.04 and 2026.03. Mitigations are available with MEONA 2025.04.24 and 2026.03.02 (planned Q4 2026); see Mesalvo Security Advisory MSA-2026-001.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-20 12:27 UTC
CWE
- CWE-284 - Improper Access Control
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://mesalvo.com/en/vdp/advisories/msa-2026-001.pdf | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mesalvo | Meona Client |
Affected:
2024.10
(custom)
Affected: 2025.04 (custom) Affected: 2026.03 (custom) |
|
| Mesalvo | Meona Server |
Affected:
2024.10
(custom)
Affected: 2025.04 (custom) Affected: 2026.03 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-0856",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-20T12:27:02.745163Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-20T12:27:12.637Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Meona Client",
"vendor": "Mesalvo",
"versions": [
{
"status": "affected",
"version": "2024.10",
"versionType": "custom"
},
{
"status": "affected",
"version": "2025.04",
"versionType": "custom"
},
{
"status": "affected",
"version": "2026.03",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Meona Server",
"vendor": "Mesalvo",
"versions": [
{
"status": "affected",
"version": "2024.10",
"versionType": "custom"
},
{
"status": "affected",
"version": "2025.04",
"versionType": "custom"
},
{
"status": "affected",
"version": "2026.03",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Access Control vulnerability in Mesalvo MEONA (MEONA Client and MEONA Server) allows an authenticated MEONA user to access administrative functions of the MEONA Client (admin panel). The MEONA Server does not independently verify the role asserted by the MEONA Client. A user who holds a valid MEONA user account and is able to execute a modified copy of the MEONA Client on a device within the operating hospital\u0027s network can assert an administrator role and access administrative functions with regular user credentials.\u003cbr\u003eExploitation requires: (1) a valid MEONA user account issued by the operating hospital; (2) network access to the MEONA Server, which is operated exclusively within closed hospital networks without exposure to the public Internet (where a hospital permits remote access to that network at all, it is only through the hospital\u0027s own remote-access infrastructure (e.g. VPN) under the hospital\u0027s control); (3) the ability to modify MEONA Client binaries and to execute the modified copy on a device in that network. On managed devices with application control, as recommended in Mesalvo\u0027s hardening guidance (MSA-2026-001), this requires local administrator privileges on the device. Mesalvo is not aware of any exploitation outside the reported security test.\u003cbr\u003eThis issue affects MEONA Client and MEONA Server in versions 2024.10, 2025.04 and 2026.03. Mitigations are available with MEONA 2025.04.24 and 2026.03.02 (planned Q4 2026); see Mesalvo Security Advisory MSA-2026-001."
}
],
"value": "Improper Access Control vulnerability in Mesalvo MEONA (MEONA Client and MEONA Server) allows an authenticated MEONA user to access administrative functions of the MEONA Client (admin panel). The MEONA Server does not independently verify the role asserted by the MEONA Client. A user who holds a valid MEONA user account and is able to execute a modified copy of the MEONA Client on a device within the operating hospital\u0027s network can assert an administrator role and access administrative functions with regular user credentials.\nExploitation requires: (1) a valid MEONA user account issued by the operating hospital; (2) network access to the MEONA Server, which is operated exclusively within closed hospital networks without exposure to the public Internet (where a hospital permits remote access to that network at all, it is only through the hospital\u0027s own remote-access infrastructure (e.g. VPN) under the hospital\u0027s control); (3) the ability to modify MEONA Client binaries and to execute the modified copy on a device in that network. On managed devices with application control, as recommended in Mesalvo\u0027s hardening guidance (MSA-2026-001), this requires local administrator privileges on the device. Mesalvo is not aware of any exploitation outside the reported security test.\nThis issue affects MEONA Client and MEONA Server in versions 2024.10, 2025.04 and 2026.03. Mitigations are available with MEONA 2025.04.24 and 2026.03.02 (planned Q4 2026); see Mesalvo Security Advisory MSA-2026-001."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284: Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T15:44:21.119Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://mesalvo.com/en/vdp/advisories/msa-2026-001.pdf"
}
],
"source": {
"discovery": "UNKNOWN"
},
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "MEONA 2025.04.24 and 2026.03.02 (Q4 2026) introduce code signing of all MEONA Client executables and assemblies and integrity verification of the client assemblies at start-up. Operators should enforce application control on MEONA workstations so that only Mesalvo-signed binaries execute, withhold local administrator rights from clinical users, provision MEONA users through the hospital\u0027s central identity and access management, and keep the MEONA network zone segmented without Internet exposure. Details: Mesalvo Security Advisory MSA-2026-001."
}
],
"value": "MEONA 2025.04.24 and 2026.03.02 (Q4 2026) introduce code signing of all MEONA Client executables and assemblies and integrity verification of the client assemblies at start-up. Operators should enforce application control on MEONA workstations so that only Mesalvo-signed binaries execute, withhold local administrator rights from clinical users, provision MEONA users through the hospital\u0027s central identity and access management, and keep the MEONA network zone segmented without Internet exposure. Details: Mesalvo Security Advisory MSA-2026-001."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-0856",
"datePublished": "2026-05-20T10:38:53.881Z",
"dateReserved": "2026-01-12T06:14:09.204Z",
"dateUpdated": "2026-09-25T15:44:21.119Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}