Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Vexa meeting bot lets anyone view transcripts

CVE-2026-25058 · published 6 months ago
Summary

The Vexa meeting bot API allowed anyone to request the transcript of any meeting without proving who they are. This could let a stranger read confidential business talks, passwords, or personal data. Upgrade to the latest version of Vexa to close the open endpoint.

Original advisory text
Vexa's unauthenticated internal transcript endpoint exposed by default
Vexa is an open-source, self-hostable meeting bot API and meeting transcription API. Prior to 0.10.0-260419-1910, the Vexa transcription-collector service exposes an internal endpoint `GET /internal/transcripts/{meeting_id}` that returns transcript data for any meeting without any authentication or authorization checks. An unauthenticated attacker can enumerate all meeting IDs, access any user's meeting transcripts without credentials, and steal confidential business conversations, passwords, and/or PII. Version 0.10.0-260419-1910 patches the issue.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
7.5 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-306Missing Authentication for Critical Function
CWE-862Missing Authorization
Timeline
Published20 Apr 2026
Updated4 Nov 2026
First seen20 Apr 2026
Sources
CVE-2026-25058 · NVD
CVE-2026-25058 · OSV
GHSA-w73r-2449-qwgh · GHSA
Track software like this
Free during beta