A critical authentication bypass in the Vexa meeting bot API allows unauthenticated attackers to remotely access and exfiltrate private meeting transcripts and sensitive information.

This vulnerability involves a missing authentication and authorization check (CWE-306 and CWE-862) within the transcription-collector service. An unauthenticated attacker can query the internal endpoint to enumerate meeting IDs and retrieve confidential transcripts without providing any credentials.

The exposure of internal meeting transcripts presents a severe risk to organizational confidentiality. Attackers could harvest sensitive business strategies, passwords, or personally identifiable information (PII) discussed during meetings. With a CVSS score of 7.5, this vulnerability represents a high-severity risk to data privacy and corporate compliance.

Immediate Action: Update the Vexa software to version 0.10.0-260419-1910 or later immediately to enforce necessary authentication checks.

Proactive Monitoring: Review access logs for the /internal/transcripts/ endpoint to identify unauthorized GET requests or patterns of meeting ID enumeration.

Compensating Controls: If an immediate update is not possible, restrict network access to the transcription-collector service via a firewall or reverse proxy to ensure only authorized internal traffic can reach the endpoint.

Public Exploit Available: Unknown

Given that this vulnerability allows for the unauthenticated theft of sensitive business communications, it should be treated as a high priority for remediation. Administrators must verify their current version of Vexa and apply the provided patch immediately. If the service is internet-facing, ensure that perimeter controls are in place to block unauthorized access while the update is being staged.