# CVE-2026-0856: Mesalvo Meona improper access control in admin panel

Source: https://junglewise.ai/threats/cve-2026-0856-mesalvo-meona-improper-access-control-in-admin-panel  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-20. Updated: 2026-05-20  
License: CC BY 4.0 with a link back

CVE-2026-0856 · Severity: high · CVSS 7.8 · Published 2026-05-20

Mesalvo Meona is a healthcare application used to manage patient data and clinical workflows. A security flaw in how the system checks user permissions allows a standard user to bypass security restrictions and access the administrative control panel. This could lead to unauthorized access to sensitive patient information, system configurations, and full control over the application's administrative functions.

Technologies: [Mesalvo Meona Client Launcher Component](https://junglewise.ai/threats/technologies/meona-client-launcher-component), [Mesalvo Meona Server Component](https://junglewise.ai/threats/technologies/meona-server-component). Vendors: [Mesalvo](https://junglewise.ai/threats/vendors/mesalvo).

## Quick answers

**Is CVE-2026-0856 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-0856 being exploited in the wild.

**How severe is CVE-2026-0856?** High severity, with a CVSS score of 7.8, published 20 May 2026.

**Which products and versions are affected?** Mesalvo Meona Client Launcher Component through 19.06.2020 15:11:49; Mesalvo Meona Server Component through 2025.04 5+323020.

**Is there a fix for CVE-2026-0856?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-0856 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-0856?** Check whether you run Mesalvo Meona Client Launcher Component or Mesalvo Meona Server Component at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is classified as Improper Access Control (CWE-284) within the Meona Client Launcher and Server components. The root cause is a failure of the backend server to verify the authorization levels of provided user credentials when accessing administrative interfaces. An attacker with low-privileged local access to the application can bypass client-side restrictions to interact with the admin panel. This allows for full control over data and functions within the portal, which can be further leveraged for lateral movement or data exfiltration. The issue was identified in Meona Server version 2025.04 5+323020 and Client Launcher version 19.06.2020 15:11:49.

## Affected products

- Mesalvo Meona Client Launcher Component through 19.06.2020 15:11:49
- Mesalvo Meona Server Component through 2025.04 5+323020

## Timeline

- 2026-01-08: other: Notified manufacturer and requested CVE identifiers
- 2026-01-12: other: Received CVE identifiers
- 2026-05-13: disclosed: Initial blog post release by SecCore
- 2026-05-20: advisory: NVD publication date

## References

- [https://seccore.at/blog/cves-meona/](https://seccore.at/blog/cves-meona/)

## Related threats

- [Mesalvo Meona insufficient data verification in feedback functionality](https://junglewise.ai/threats/cve-2026-25602-mesalvo-meona-insufficient-data-verification-in-feedback)
- [Mesalvo Meona incorrect privilege assignment in SQL interface](https://junglewise.ai/threats/cve-2026-22315-mesalvo-meona-incorrect-privilege-assignment-in-sql-interface)
- [Mesalvo Meona code injection in Client Launcher and Server components](https://junglewise.ai/threats/cve-2026-22314-mesalvo-meona-code-injection-in-client-launcher-and-server)
- [Mesalvo Meona cleartext storage of sensitive information in memory](https://junglewise.ai/threats/cve-2026-0857-mesalvo-meona-cleartext-storage-of-sensitive-information-in-memory)