CVE-2026-33005
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
Improper Handling of Insufficient Privileges in Apache OpenMeetings allows any registered user to query the web service with their credentials and get files/sub-folders of any folder by ID (metadata only, not contents). This affects Apache OpenMeetings from 3.10 before 9.0.0; users should upgrade to 9.0.0.
Risk Assessment
A registered user may obtain metadata of folders they should not access, potentially revealing resource structure and names.
Recommendation
Upgrade Apache OpenMeetings to version 9.0.0 or later.
Other vulnerabilities in Apache OpenMeetings
See all- CVE-2017-7688High
Apache OpenMeetings version 1.0.0 updates user passwords in an insecure manner, potentially allowing unauthorized access.
- CVE-2017-7684High
Apache OpenMeetings version 1.0.0 does not check the contents of uploaded files. An attacker can cause a denial of service by uploading multiple large files to the server.
- CVE-2017-7683High
Apache OpenMeetings version 1.0.0 discloses Tomcat version and detailed error stack trace, which is not secure.
- CVE-2017-7682High
Apache OpenMeetings version 3.2.0 is vulnerable to parameter manipulation attacks, allowing an attacker to access restricted areas.
- CVE-2017-7681High
Apache OpenMeetings version 1.0.0 is vulnerable to SQL injection. This allows authenticated users to modify the structure of the existing query and leak the structure of other queries being made by the application in the back-end.
- CVE-2017-7680High
Apache OpenMeetings version 1.0.0 has an overly permissive crossdomain.xml file, allowing Flash content to be loaded from untrusted domains.
- CVE-2017-7666High
Apache OpenMeetings version 1.0.0 is vulnerable to Cross-Site Request Forgery (CSRF) attacks, XSS attacks, click-jacking, and MIME based attacks.
- CVE-2016-2164High
The FileService.importFileByInternalUserId and FileService.importFile SOAP API methods in Apache OpenMeetings before version 3.1.1 improperly use the Java URL class without checking the specified protocol handler, allowing remote attackers to read arbitrary files by attempting to upload a file.
- CVE-2016-0783High
The sendHashByUser function in Apache OpenMeetings before version 3.1.1 generates predictable password reset tokens, making it easier for remote attackers to reset arbitrary user passwords by leveraging knowledge of a user name and the current system time.
- CVE-2016-8736Critical
Apache OpenMeetings before 3.1.2 is vulnerable to Remote Code Execution via RMI deserialization attack.
Original NVD description (English source)
Improper Handling of Insufficient Privileges vulnerability in Apache OpenMeetings. Any registered user can query web service with their credentials and get files/sub-folders of any folder by ID (metadata only NOT contents). Metadata includes id, type, name and some other field. Full list of fields get be checked at FileItemDTO object. This issue affects Apache OpenMeetings: from 3.10 before 9.0.0. Users are recommended to upgrade to version 9.0.0, which fixes the issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS