CVE-2026-33005: Apache OpenMeetings: Insufficient checks in FileWebService
Improper Handling of Insufficient Privileges vulnerability in Apache OpenMeetings.
Any registered user can query web service with their credentials and get files/sub-folders of any folder by ID (metadata only NOT contents). Metadata includes id, type, name and some other field. Full list of fields get be checked at FileItemDTO object.
This issue affects Apache OpenMeetings: from 3.10 before 9.0.0.
Users are recommended to upgrade to version 9.0.0, which fixes the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33005?
The severity of CVE-2026-33005 is rated as medium with a score of 4.3.
How do I fix CVE-2026-33005?
To fix CVE-2026-33005, update Apache OpenMeetings to the latest version that addresses insufficient privilege checks.
What type of vulnerability is CVE-2026-33005?
CVE-2026-33005 is an Improper Handling of Insufficient Privileges vulnerability.
What can attackers do with CVE-2026-33005?
Attackers can use CVE-2026-33005 to query the web service and retrieve metadata of files and sub-folders based on their IDs.
Who is affected by CVE-2026-33005?
Any registered user of Apache OpenMeetings is affected by CVE-2026-33005 due to inadequate privilege checks.