MeetingHub, a product from HAMASTAR Technology, contains a missing authentication flaw that permits attackers who are not logged in to reach certain web API endpoints and retrieve meeting details. The vulnerability is a direct consequence of improper access control (CWE-306) and enables remote actors to gain confidential information from the system, potentially exposing participant data and meeting schedules without any legitimate credential. The primary impact is a breach of confidentiality for all individuals whose meetings are stored or processed by the application.

Unpatched versions of HAMASTAR Technology's MeetingHub Paperless Meetings are affected. The vendor recommends applying the patch released on 20251210 or any later version to eliminate the flaw. All deployments that use MeetingHub without this update are potentially vulnerable.

The CVSS score of 6.9 indicates a moderate severity, while the EPSS of less than 1% suggests a low probability of exploitation in the wild at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerability catalog. Attackers can exploit the flaw remotely by sending unauthenticated HTTP or HTTPS requests to exposed API endpoints, a vector inferred from the lack of required authentication in the description. Because the flaw exposes sensitive data, it is advisable to mitigate promptly.