GHSA-78cg-fc6c-w44w: Apache OpenMeetings: Insufficient checks in FileWebService

Q: Who can exploit this issue?

Any registered Apache OpenMeetings user can query the affected web service using their own credentials. No elevated privileges or user interaction are required.

Q: What information could be exposed?

The issue exposes metadata for files and subfolders when an attacker knows or supplies a folder ID. Exposed metadata includes identifiers, type, name, and other FileItemDTO fields, but not file contents.

Q: Which deployments are affected?

Apache OpenMeetings versions from 3.10 before 9.0.0 are affected. Version 9.0.0 fixes the issue.

Published Apr 9, 2026

Updated

Improper Handling of Insufficient Privileges vulnerability in Apache OpenMeetings.

Any registered user can query web service with their credentials and get files/sub-folders of any folder by ID (metadata only NOT contents). Metadata includes id, type, name and some other field. Full list of fields get be checked at FileItemDTO object.

This issue affects Apache OpenMeetings: from 3.10 before 9.0.0.

Users are recommended to upgrade to version 9.0.0, which fixes the issue.

Affected Software

1 affected component

Apache OpenMeetings>=3.10<9.0.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache OpenMeetings to a version that resolves this vulnerability.
Fixed in 9.0.0

Event History

Apr 9, 2026

CVE Published

via OSV·03:52 PM

Data Sourced

via OSV·03:52 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Any registered Apache OpenMeetings user can query the affected web service using their own credentials. No elevated privileges or user interaction are required.

What information could be exposed?

The issue exposes metadata for files and subfolders when an attacker knows or supplies a folder ID. Exposed metadata includes identifiers, type, name, and other FileItemDTO fields, but not file contents.

Which deployments are affected?

Apache OpenMeetings versions from 3.10 before 9.0.0 are affected. Version 9.0.0 fixes the issue.

GHSA-78cg-fc6c-w44w: Apache OpenMeetings: Insufficient checks in FileWebService

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What information could be exposed?

Which deployments are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What information could be exposed?

Which deployments are affected?