Apache OpenMeetings insufficient authorization vulnerability

MEDIUM 5.3CVE-2023-28936 · GHSA-v93h-rwj8-78qh · Published 12/05/2023 · updated 17/06/2026

In short

CVE-2023-28936 is a MEDIUM (CVSS 5.3) vulnerability affecting org.apache.openmeetings:openmeetings-db, openmeetings (apache).
Chance of exploitation in the next 30 days (EPSS): 1.2%, higher than 68.3% of all vulnerabilities.
Fix: update to 7.1.0 or later.

Package	Affected versions	Patched versions
org.apache.openmeetings:openmeetings-db Maven	`≥ 2.0.0, < 7.1.0`	`7.1.0`
openmeetings apache	`≥ 2.0.0, < 7.1.0`	`7.1.0`

Attacker can access arbitrary recording/room

Vendor: The Apache Software Foundation

Versions Affected: Apache OpenMeetings from 2.0.0 before 7.1.0

NVD description

Attacker can access arbitrary recording/room Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.0.0 before 7.1.0

Running one of these products? Scan your site to see whether it exposes a vulnerable version.