CVE-2026-33005 - Apache OpenMeetings: Insufficient checks in FileWebService

Back Back to CVE browser

MEDIUM

Apache OpenMeetings: Insufficient checks in FileWebService

Published Apr 9, 2026

5.3

MEDIUM

CVSS 4.0

EPSS 0.65%

Description

Improper Handling of Insufficient Privileges vulnerability in Apache OpenMeetings.

Any registered user can query web service with their credentials and get files/sub-folders of any folder by ID (metadata only NOT contents). Metadata includes id, type, name and some other field. Full list of fields get be checked at FileItemDTO object.

This issue affects Apache OpenMeetings: from 3.10 before 9.0.0.

Users are recommended to upgrade to version 9.0.0, which fixes the issue.

Affected products

Vendor Apache Software Foundation Product Apache OpenMeetings Default
unaffected
- Version
  3.1.0
  Status
  affected
  Constraints
  <9.0.0

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Apache Software Foundation

Apache OpenMeetings

unaffected

Version	Status	Constraints
3.1.0	affected	<9.0.0

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-274

References (5)

http://www.openwall.com/lists/oss-security/2026/04/09/10
Mailing ListThird Party Advisory
https://github.com/advisories/GHSA-78cg-fc6c-w44w
Advisory
https://lists.apache.org/thread/pttoprd628g3xr6lpp3bm1z8m3z8t4p7
vendor-advisoryMailing ListVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-33005
https://openmeetings.apache.org/openmeetings-db/apidocs/org.apache.openmeetings.db/org/apache/openmeetings/db/dto/file/FileItemDTO.html
technical-descriptionProduct

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2026/04/09/10		Mailing ListThird Party Advisory
https://github.com/advisories/GHSA-78cg-fc6c-w44w		Advisory
https://lists.apache.org/thread/pttoprd628g3xr6lpp3bm1z8m3z8t4p7		vendor-advisoryMailing ListVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-33005
https://openmeetings.apache.org/openmeetings-db/apidocs/org.apache.openmeetings.db/org/apache/openmeetings/db/dto/file/FileItemDTO.html		technical-descriptionProduct