tl;dv, an AI meeting recording service integrated with Google Meet, Zoom, and Teams, uses a Firestore database to store meeting metadata. Due to missing tenant isolation in the 'meetings' collection, any authenticated user can query and retrieve all meetings across all accounts, including live conference IDs that allow joining active calls uninvited. The vulnerability was discovered and responsibly disclosed in January 2026 but remained unaddressed six months later. The exposed data includes creator emails, conference IDs, recording status, and timestamps for over 181,000 meetings from more than 84,000 users across 35,000 domains, including government and educational institutions worldwide. Furthermore, an internal employee directory API is accessible without authentication, exposing employee names and emails. The vendor has not responded to multiple disclosures and has not remediated the issue.

This vulnerability allows unauthorized access to sensitive meeting metadata and live conference sessions, compromising the confidentiality of government, corporate, and academic video calls. Attackers can join live meetings uninvited, potentially eavesdropping on confidential discussions and accessing sensitive information. The exposure of internal employee data via an unauthenticated API further increases the risk of targeted attacks such as phishing or social engineering. The lack of tenant isolation in the database significantly undermines user privacy and trust in the platform.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor must implement Firestore security rules to enforce tenant isolation on the 'meetings' collection, restricting access to only authorized users. Additionally, the unauthenticated internal API endpoints should be secured or disabled. Users and organizations relying on tl;dv should be cautious about sensitive content shared on the platform until the issue is resolved. Continued follow-up with the vendor is recommended to ensure remediation.