This vulnerability (CVE-2026-0856) involves improper access control (CWE-284) in the Mesalvo Meona Client Launcher and Server Components. It enables users with normal privileges to access the administrative panel, potentially leading to full control over the affected components. The CVSS 3.1 vector indicates the attack requires local access with low complexity, low privileges, no user interaction, and results in high confidentiality, integrity, and availability impacts. The affected versions are specified as Meona Client Launcher Component through mid-2020 and Meona Server Component through April 2025. No patch or official remediation level has been provided by the vendor or authoritative sources.

Successful exploitation allows a normal user to bypass access controls and gain administrative access to the Meona components, potentially compromising confidentiality, integrity, and availability of the system. This could lead to unauthorized administrative actions and control over the affected software components.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor vendor communications for updates. Until a patch is available, restrict local access to trusted users only to reduce risk.