The reported flaw is an incorrect privilege assignment in the Mesalvo Meona Client Launcher Component and Server Component that permits a user to export user data through the SQL editor without proper access checks. This capability can reveal clear‑text passwords along with other sensitive account information. The consequence is a violation of confidentiality that could enable an attacker to impersonate legitimate users or compromise downstream systems that rely on those credentials.

Affected vendors include Mesalvo, with the Meona Client Launcher Component up to version 19.06.2020 15:11:49 and the Meona Server Component up to version 2025.04 5+323020. Both components provide the vulnerable SQL editor interface.

The CVSS score of 7.2 reflects a moderate‑to‑high severity risk. The EPSS score is currently unavailable, and the vulnerability is not listed in CISA’s KEV catalog. Because the issue stems from an incorrect privilege model exercised via the SQL editor, the attack vector is likely internal or through authenticated access, but could be expanded if the editor is reachable over a network. Attackers would simply execute a query that exports the user dataset, gaining full credential exposure without needing additional privileges.