CVE-2026-33005

Improper Handling of Insufficient Privileges vulnerability in Apache OpenMeetings. Any registered user can query web service with their credentials and get files/sub-folders of any folder by ID (metadata only NOT contents). Metadata includes id, type, name and some other field. Full list of fields get be checked at FileItemDTO object. This issue affects Apache OpenMeetings: from 3.10 before 9.0.0. Users are recommended to upgrade to version 9.0.0, which fixes the issue.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/pttoprd628g3xr6lpp3bm1z8m3z8t4p7	Mailing List Vendor Advisory
https://openmeetings.apache.org/openmeetings-db/apidocs/org.apache.openmeetings.db/org/apache/openmeetings/db/dto/file/FileItemDTO.html	Product
http://www.openwall.com/lists/oss-security/2026/04/09/10	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:openmeetings:*:*:*:*:*:*:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Vulnerabilidad de Manejo Inadecuado de Privilegios Insuficientes en Apache OpenMeetings. Cualquier usuario registrado puede consultar el servicio web con sus credenciales y obtener archivos/subcarpetas de cualquier carpeta por ID (solo metadatos, NO el contenido). Los metadatos incluyen id, tipo, nombre y algún otro campo. La lista completa de campos se puede consultar en el objeto FileItemDTO. Este problema afecta a Apache OpenMeetings: desde 3.10 antes de 9.0.0. Se recomienda a los usuarios actualizar a la versión 9.0.0, que corrige el problema.

Information

Published : 2026-04-09 16:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-33005

Mitre link : CVE-2026-33005

CVE.ORG link : CVE-2026-33005

JSON object : View

Products Affected

apache

openmeetings

CWE

CWE-274

Improper Handling of Insufficient Privileges

{"id": "CVE-2026-33005", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33005", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-10T18:44:03.788543Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache OpenMeetings", "versions": [{"status": "affected", "version": "3.1.0", "lessThan": "9.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-04-09T16:16:26.823", "references": [{"url": "https://lists.apache.org/thread/pttoprd628g3xr6lpp3bm1z8m3z8t4p7", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "https://openmeetings.apache.org/openmeetings-db/apidocs/org.apache.openmeetings.db/org/apache/openmeetings/db/dto/file/FileItemDTO.html", "tags": ["Product"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/04/09/10", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-274"}]}], "descriptions": [{"lang": "en", "value": "Improper Handling of Insufficient Privileges vulnerability in Apache OpenMeetings.\n\nAny registered user can query web service with their credentials and get files/sub-folders of any folder by ID (metadata only NOT contents). Metadata includes id, type, name and some other field. Full list of fields get be checked at\u00a0FileItemDTO\u00a0object.\n\nThis issue affects Apache OpenMeetings: from 3.10 before 9.0.0.\n\nUsers are recommended to upgrade to version 9.0.0, which fixes the issue."}, {"lang": "es", "value": "Vulnerabilidad de Manejo Inadecuado de Privilegios Insuficientes en Apache OpenMeetings.\n\nCualquier usuario registrado puede consultar el servicio web con sus credenciales y obtener archivos/subcarpetas de cualquier carpeta por ID (solo metadatos, NO el contenido). Los metadatos incluyen id, tipo, nombre y alg\u00fan otro campo. La lista completa de campos se puede consultar en el objeto FileItemDTO.\n\nEste problema afecta a Apache OpenMeetings: desde 3.10 antes de 9.0.0.\n\nSe recomienda a los usuarios actualizar a la versi\u00f3n 9.0.0, que corrige el problema."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:openmeetings:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DDF05947-6FA6-438F-83E5-F484EC43F6B2", "versionEndExcluding": "9.0.0", "versionStartIncluding": "3.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}