CVE-2026-33005

Description

Improper Handling of Insufficient Privileges vulnerability in Apache OpenMeetings. Any registered user can query web service with their credentials and get files/sub-folders of any folder by ID (metadata only NOT contents). Metadata includes id, type, name and some other field. Full list of fields get be checked at FileItemDTO object. This issue affects Apache OpenMeetings: from 3.10 before 9.0.0. Users are recommended to upgrade to version 9.0.0, which fixes the issue.

PUBLISHED Reserved 2026-03-17 | Published 2026-04-09 | Updated 2026-04-10 | Assigner apache

Problem types

CWE-274 Improper Handling of Insufficient Privileges

Product status

Credits

4ra2n (A code security AI agent) finder

References

www.openwall.com/lists/oss-security/2026/04/09/10

openmeetings.apache.org/...ings/db/dto/file/FileItemDTO.html technical-description

lists.apache.org/thread/pttoprd628g3xr6lpp3bm1z8m3z8t4p7 vendor-advisory

cve.org (CVE-2026-33005)

nvd.nist.gov (CVE-2026-33005)

Download JSON