CVE-2026-25602

MediumCVSS 4.4

Published: 20/05/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.09%

1th percentile - higher than 1% of all known CVEs

Summary

Insufficient data authenticity verification in Meona Client Launcher and Meona Server components allows sending messages to any email address.

Risk Assessment

An attacker could send spoofed emails on behalf of the system, potentially leading to phishing attacks or reputational damage.

Recommendation

Update Meona components to a version newer than those specified in the vulnerability description.

Original NVD description (English source)

Insufficient Verification of Data Authenticity vulnerability in Mesalvo Meona Client Launcher Component, Mesalvo Meona Server Component makes it possible to send messages to any email address. This issue affects Meona Client Launcher Component: through 19.06.2020 15:11:49; Meona Server Component: through 2025.04 5+323020.