Insufficient Privileges Vulnerability in Apache OpenMeetings
CVE-2026-33005

4.3MEDIUM

Key Information:

Vendor

Apache
Status
Apache Openmeetings
Vendor
CVE Published:
9 April 2026

What is CVE-2026-33005?

The vulnerability in Apache OpenMeetings permits registered users to exploit web services using their credentials to access file metadata for any folder by its ID. This unauthorized access discloses information such as ID, type, name, and additional metadata associated with files and sub-folders. It is essential for users to upgrade to version 9.0.0 to mitigate this issue and safeguard sensitive information.

Affected Version(s)

Apache OpenMeetings 3.1.0 < 9.0.0

References

https://openmeetings.apache.org/openmeetings-db/apidocs/o...
technical-description
https://lists.apache.org/thread/pttoprd628g3xr6lpp3bm1z8m...
vendor-advisory

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

4ra2n (A code security AI agent)
.