An incorrect privilege assignment in Mesalvo Meona components enables high-privileged users to exfiltrate sensitive data, including cleartext passwords, creating a critical information disclosure risk.

This is an incorrect privilege assignment vulnerability (CWE-266) that permits users with existing high-level privileges to perform unauthorized data exports through the SQL editor interface.

The ability to extract cleartext passwords and sensitive user data poses a severe threat to data confidentiality and regulatory compliance. With a CVSS score of 7.2, the vulnerability allows for significant exposure of credentials that could be reused to escalate access across the broader enterprise environment.

Immediate Action: Apply the vendor-provided security updates immediately to rectify the privilege assignment logic.

Proactive Monitoring: Audit access to the SQL editor and review logs for large or unusual data export queries that may indicate malicious activity.

Compensating Controls: Implement strict role-based access control (RBAC) to limit access to the SQL editor to the absolute minimum number of authorized personnel.

Public Exploit Available: No (exploit_available: false)

Organizations using Mesalvo Meona should prioritize this update to prevent the potential exfiltration of sensitive credentials. Ensure that all administrative accounts are monitored and that privilege levels are strictly enforced.