This vulnerability (CVE-2026-22315) is categorized under CWE-266 (Incorrect Privilege Assignment) and affects Mesalvo's Meona Client Launcher and Server Components. It enables an attacker with high privileges to export sensitive user data, including cleartext passwords, through the SQL editor interface. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The issue affects specific versions of the software as noted, with no cloud service implications. No official fix or patch has been documented as of the publication date.

Successful exploitation can lead to unauthorized disclosure of sensitive user data, including cleartext passwords, compromising confidentiality. The integrity and availability of the affected components can also be impacted due to the high CVSS impact metrics. This poses a significant risk to organizations using the affected versions of Mesalvo Meona Client Launcher and Server Components.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation has been published, organizations should monitor vendor communications closely. Until a patch is available, restrict access to the SQL editor and limit privileges to trusted administrators only to reduce risk.