Medium severity · published Apr 9, 2026
CVE-2026-33005
Apache OpenMeetings: Insufficient checks in FileWebService
4.3
CVSS
0.4%
EPSS
No
On KEV
Description
Improper Handling of Insufficient Privileges vulnerability in Apache OpenMeetings.
Any registered user can query web service with their credentials and get files/sub-folders of any folder by ID (metadata only NOT contents). Metadata includes id, type, name and some other field. Full list of fields get be checked at FileItemDTO object.
This issue affects Apache OpenMeetings: from 3.10 before 9.0.0.
Users are recommended to upgrade to version 9.0.0, which fixes the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AO
Apache OpenMeetings · Apache Software Foundation
3.1.0 before 9.0.0 · source: vendor
OP
Openmeetings · Apache
3.1.0 before 9.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-33005
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-33005
Mailing List
https://lists.apache.org/thread/pttoprd628g3xr6lpp3bm1z8m3z8t4p7
Product
https://openmeetings.apache.org/openmeetings-db/apidocs/org.apache.openmeetings.db/org/apache/openmeetings/db/dto/file/FileItemDTO.html
Mailing List
http://www.openwall.com/lists/oss-security/2026/04/09/10
More from Apache OpenMeetings
9.8
CVE-2024-54676
Apache OpenMeetings: Deserialisation of untrusted data in cluster mode
7.5
CVE-2026-33266
Apache OpenMeetings: Hardcoded Remember-Me Cookie Encryption Key and Salt
7.5
CVE-2026-34020
Apache OpenMeetings: Login Credentials Passed via GET Query Parameters
6.5
CVE-2026-49488
Apache OpenMeetings: Arbitrary File Read