The flaw is an improper access control in Mesalvo MEONA Client and Server. An authenticated user can modify the client executable and, when run on a device within the hospital network, claim administrator role because the server does not independently verify the role asserted by the client. This grants the user privileged access to the admin panel, allowing configuration changes and potential compromise of application integrity.

Affected vendors are Mesalvo. The Meona Client and Meona Server components are affected in versions 2024.10, 2025.04, and 2026.03. Operators should verify deployed versions against these dates.

The CVSS score of 7.8 indicates high severity, while the EPSS score of <1% suggests limited public exploitation. The vulnerability is not listed in CISA KEV. Attackers require a valid MEONA user account, network access to the MEONA Server within the hospital LAN, and the ability to modify and execute a copy of the client. On managed devices with application control, this typically requires local administrator privileges. Once conditions are met, the attacker can elevate privileges and access administrative functions without further authentication.