Meelo versions up to 3.13.1 suffer a missing authorization flaw that lets any authenticated user, regardless of role, modify catalog items for songs, tracks, and videos. The vulnerability resides in the RolesGuard that fails to check for an Admin privilege on write routes. Attackers can send PUT requests to update individual items or POST to merge endpoints, thereby changing genres, reassigning tracks, and altering metadata. The flaw constitutes a violation of integrity controls and is aligned with CWE‑862.

Affected systems are deployments of the Arthi‑chaud Meelo application running version 3.13.1. The codebase for this version includes the vulnerable RolesGuard implementation, which can be observed in the referenced GitHub files. Users who authenticate with any account can exploit the issue.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score is not available, suggesting no current evidence of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker needs only to be authenticated; no privileged access is required. By sending crafted HTTP requests to the exposed endpoints, an attacker can alter catalog data, which could lead to mislabeling or disruption of media content for end users.