What’s Vulnerable › Vulnerabilities

CVE-2026-33005: Apache OpenMeetings: Insufficient checks in FileWebService

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-09 · updated 2026-10-26
• Weakness: CWE-274

Description

Improper Handling of Insufficient Privileges vulnerability in Apache OpenMeetings. Any registered user can query web service with their credentials and get files/sub-folders of any folder by ID (metadata only NOT contents). Metadata includes id, type, name and some other field. Full list of fields get be checked at FileItemDTO object. This issue affects Apache OpenMeetings: from 3.10 before 9.0.0. Users are recommended to upgrade to version 9.0.0, which fixes the issue.

Affected products

• Apache Software Foundation Apache OpenMeetings: from 3.1.0 before 9.0.0 — fixed in 9.0.0

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache OpenMeetings 9.0.0. Check the vendor advisory for mitigations.

References

• https://lists.apache.org/thread/pttoprd628g3xr6lpp3bm1z8m3z8t4p7
• https://openmeetings.apache.org/openmeetings-db/apidocs/org.apache.openmeetings.db/org/apache/openmeetings/db/dto/file/FileItemDTO.html
• http://www.openwall.com/lists/oss-security/2026/04/09/10

Get alerted when CVE-2026-33005 or the next vulnerability affects your stack