# CVE-2026-25602: Mesalvo Meona insufficient data verification in feedback functionality

Source: https://junglewise.ai/threats/cve-2026-25602-mesalvo-meona-insufficient-data-verification-in-feedback  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-20. Updated: 2026-05-20  
License: CC BY 4.0 with a link back

CVE-2026-25602 · Severity: medium · CVSS 4.4 · Published 2026-05-20

Mesalvo Meona is a healthcare application used for patient management. A vulnerability in its feedback reporting system allows an attacker to manipulate the destination of outgoing emails. This could be used by a malicious actor to send spoofed internal emails from a legitimate corporate address, facilitating social engineering or phishing attacks against employees.

Technologies: [Mesalvo Meona Client Launcher Component](https://junglewise.ai/threats/technologies/meona-client-launcher-component), [Mesalvo Meona Server Component](https://junglewise.ai/threats/technologies/meona-server-component). Vendors: [Mesalvo](https://junglewise.ai/threats/vendors/mesalvo).

## Quick answers

**Is CVE-2026-25602 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-25602 being exploited in the wild.

**How severe is CVE-2026-25602?** Medium severity, with a CVSS score of 4.4, published 20 May 2026.

**Which products and versions are affected?** Mesalvo Meona Client Launcher Component through 19.06.2020 15:11:49; Mesalvo Meona Server Component through 2025.04 5+323020.

**Is there a fix for CVE-2026-25602?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-25602 attacked?** It is attacked with local access or over the network, in a network appliance.

**Am I affected by CVE-2026-25602?** Check whether you run Mesalvo Meona Client Launcher Component or Mesalvo Meona Server Component at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists because the Meona Server Component fails to verify the recipient email address provided by the client during feedback report submissions. The application utilizes serialized Hessian objects for client-server communication. An attacker can intercept and modify these serialized objects to replace the hardcoded recipient address with an arbitrary one. Because the server does not validate this data against an allowlist or server-side configuration, it processes the request and sends the email to the attacker-specified address using the organization's legitimate internal mail server.

## Affected products

- Mesalvo Meona Client Launcher Component through 19.06.2020 15:11:49
- Mesalvo Meona Server Component through 2025.04 5+323020

## Timeline

- 2026-01-08: other: Notified manufacturer and requested CVE identifiers
- 2026-05-13: disclosed: Initial blog post release by SecCore
- 2026-05-20: advisory: CVE published to NVD

## References

- [https://seccore.at/blog/cves-meona/](https://seccore.at/blog/cves-meona/)

## Related threats

- [Mesalvo Meona incorrect privilege assignment in SQL interface](https://junglewise.ai/threats/cve-2026-22315-mesalvo-meona-incorrect-privilege-assignment-in-sql-interface)
- [Mesalvo Meona code injection in Client Launcher and Server components](https://junglewise.ai/threats/cve-2026-22314-mesalvo-meona-code-injection-in-client-launcher-and-server)
- [Mesalvo Meona cleartext storage of sensitive information in memory](https://junglewise.ai/threats/cve-2026-0857-mesalvo-meona-cleartext-storage-of-sensitive-information-in-memory)
- [Mesalvo Meona improper access control in admin panel](https://junglewise.ai/threats/cve-2026-0856-mesalvo-meona-improper-access-control-in-admin-panel)