CVE-2026-25058

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-25058

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25058.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-25058

Aliases

GHSA-w73r-2449-qwgh

Published

2026-04-20T16:03:06.639Z

Modified

2026-07-15T01:49:09.279688214Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Vexa's unauthenticated internal transcript endpoint exposed by default

Details

Vexa is an open-source, self-hostable meeting bot API and meeting transcription API. Prior to 0.10.0-260419-1910, the Vexa transcription-collector service exposes an internal endpoint GET /internal/transcripts/{meeting_id} that returns transcript data for any meeting without any authentication or authorization checks. An unauthenticated attacker can enumerate all meeting IDs, access any user's meeting transcripts without credentials, and steal confidential business conversations, passwords, and/or PII. Version 0.10.0-260419-1910 patches the issue.

Database specific

{
    "cwe_ids": [
        "CWE-306",
        "CWE-862"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25058.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "fixed": "0.10.0-260419-1910"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/vexa-ai/vexa

Affected ranges

Type

GIT

Repo

https://github.com/vexa-ai/vexa

Events

Introduced

Last affected

d06a319ecc1613bce6d83a706b225ba525506135

Database specific

{
    "cpe": "cpe:2.3:a:vexa:vexa:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.10"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

v0.*

v0.10

v0.2

v0.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25058.json"