The vulnerability CVE-2026-25058 in Vexa (versions before 0.10.0-260419-1910) involves missing authentication on the internal endpoint GET /internal/transcripts/{meeting_id}. This endpoint returns meeting transcript data without requiring any authentication or authorization, enabling attackers to retrieve transcripts of any meeting by enumerating meeting IDs. The vulnerability is categorized under CWE-306 (Missing Authentication for Critical Function) and CWE-862 (Missing Authorization). The CVSS 3.1 base score is 7.5 (High), reflecting network attack vector, no privileges required, no user interaction, and high confidentiality impact. The issue is patched in version 0.10.0-260419-1910.

An unauthenticated attacker can access sensitive transcript data of any meeting, potentially exposing confidential business conversations, passwords, personally identifiable information (PII), and other sensitive content. This compromises confidentiality but does not affect integrity or availability. There are no known exploits in the wild at this time.

Upgrade Vexa to version 0.10.0-260419-1910 or later, where the missing authentication issue on the transcription-collector internal endpoint is fixed. Since this is a self-hosted open-source product, users must apply this update themselves. Patch status is confirmed by the vendor's versioning information.