Improper Handling of Insufficient Privileges vulnerability in Apache OpenMeetings.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Apr 9, 2026 · NIST NVD

   Detected

   Improper Handling of Insufficient Privileges vulnerability in Apache OpenMeetings. Any registered user can query web service with their credentials and get files/sub-folders of any folder by ID (metadata only NOT contents). Metadata includes id, type, name and some other field. Full list of fields get be checked at FileItemDTO object. This issue affects Apache OpenMeetings: from 3.10 before 9.0.0.

2. Jun 17, 2026 · NIST NVD

   Updated

   Improper Handling of Insufficient Privileges vulnerability in Apache OpenMeetings. Any registered user can query web service with their credentials and get files/sub-folders of any folder by ID (metadata only NOT contents). Metadata includes id, type, name and some other field. Full list of fields get be checked at FileItemDTO object. This issue affects Apache OpenMeetings: from 3.10 before 9.0.0.

Affected

• cpe apache/openmeetingsversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-33005

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-33005

  Improper Handling of Insufficient Privileges vulnerability in Apache OpenMeetings. Any registered user can query web service with their credentials and get files/sub-folders of any folder by ID (metadata only NOT contents). Metadata includes id, type, name and some other field.

  nvd.nist.gov

References

• Mailing List · openwall.com
• Mailing List · lists.apache.org
• Product · openmeetings.apache.org