Apache OpenMeetings has an Improper Handling of Insufficient Privileges vulnerability

TRUNG BÌNH 4.3CVE-2026-33005 · GHSA-78cg-fc6c-w44w · Công bố 09/04/2026 · cập nhật 26/10/2026

Tóm tắt nhanh

CVE-2026-33005 là lỗ hổng mức TRUNG BÌNH (CVSS 4.3) ảnh hưởng org.apache.openmeetings:openmeetings-parent, openmeetings (apache).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.42%, cao hơn 36.1% các lỗ hổng khác.
Cách xử lý: cập nhật lên 9.0.0 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
org.apache.openmeetings:openmeetings-parent Maven	`≥ 3.10, < 9.0.0`	`9.0.0`
openmeetings apache	`≥ 3.1.0, < 9.0.0`	`9.0.0`

Mô tả

Sny registered user can query web service with their credentials and get files/sub-folders of any folder by ID (metadata only NOT contents). Metadata includes id, type, name and some other field. Full list of fields get be checked at FileItemDTO object.

This issue affects Apache OpenMeetings: from 3.10 before 9.0.0.

Users are recommended to upgrade to version 9.0.0, which fixes the issue.

Mô tả của NVD

Improper Handling of Insufficient Privileges vulnerability in Apache OpenMeetings. Any registered user can query web service with their credentials and get files/sub-folders of any folder by ID (metadata only NOT contents). Metadata includes id, type, name and some other field. Full list of fields get be checked at FileItemDTO object. This issue affects Apache OpenMeetings: from 3.10 before 9.0.0. Users are recommended to upgrade to version 9.0.0, which fixes the issue.