The feedback function in Mesalvo MEONA allows authenticated user with certain administrative roles to supply a recipient address that the server will use when sending an email. Because the server does not verify that the supplied address matches the one configured for the system, an attacker can choose an arbitrary address and send messages that appear to originate from the internal MEONA system. This flaw is a configuration error (CWE-345) that enables social‑engineering emails but does not disclose patient data or other sensitive information.

The vulnerability affects Mesalvo MEONA Client and MEONA Server components prior to the 2025.04.24 and 2026.03.02 releases. Specifically, versions 2024.10, 2025.04 (before 2025.04.24) and 2026.03 (before 2026.03.02) are impacted.

The CVSS score is 2.3, indicating low severity. The EPSS score is <1%, suggesting that exploitation is unlikely. The vulnerability is not listed in the CISA KEV catalog. Attackers need an account with an administrative role and access to the hospital’s internal network, typically via VPN, to exploit the flaw. Once exploited, they can send spoofed emails that appear to come from the hospital’s MEONA system.