{"id":"CVE-2026-33005","aliases":["EUVD-2026-20934","GHSA-78cg-fc6c-w44w"],"status":"published","title":"Apache OpenMeetings: Insufficient checks in FileWebService","description":"Improper Handling of Insufficient Privileges vulnerability in Apache OpenMeetings.\n\nAny registered user can query web service with their credentials and get files/sub-folders of any folder by ID (metadata only NOT contents). Metadata includes id, type, name and some other field. Full list of fields get be checked at FileItemDTO object.\n\nThis issue affects Apache OpenMeetings: from 3.10 before 9.0.0.\n\nUsers are recommended to upgrade to version 9.0.0, which fixes the issue.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00425,"percentile":0.37093,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-274"],"published":"2026-04-09T15:52:50Z","modified":"2026-11-08T02:47:36Z","fixes":[{"ecosystem":"Maven","package":"org.apache.openmeetings:openmeetings-parent","fixed_in":["9.0.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.openmeetings:openmeetings-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.10"},{"fixed":"9.0.0"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.openmeetings:openmeetings-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.10"},{"fixed":"9.0.0"}]}],"versions":["4.0.0","4.0.1","4.0.10","4.0.11","4.0.3","4.0.4","4.0.5","4.0.6","4.0.7","4.0.9","5.0.0","5.0.0-M1","5.0.0-M2","5.0.0-M3","5.0.0-M4","5.1.0","6.2.0","6.3.0","7.0.0","7.2.0","8.0.0","8.1.0"]}],"products":[{"vendor":"apache","product":"openmeetings"},{"vendor":"apache software foundation","product":"apache openmeetings"}],"references":[{"url":"https://openmeetings.apache.org/openmeetings-db/apidocs/org.apache.openmeetings.db/org/apache/openmeetings/db/dto/file/FileItemDTO.html","tags":["technical-description","Product","article","web"]},{"url":"https://lists.apache.org/thread/pttoprd628g3xr6lpp3bm1z8m3z8t4p7","tags":["vendor-advisory","Mailing List","Vendor Advisory","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2026/04/09/10","tags":["Mailing List","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33005","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-78cg-fc6c-w44w"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33005.json","tags":["advisory"]},{"url":"https://github.com/apache/openmeetings","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-33005","title":"Apache OpenMeetings: Insufficient checks in FileWebService","description":"Improper Handling of Insufficient Privileges vulnerability in Apache OpenMeetings.\n\nAny registered user can query web service with their credentials and get files/sub-folders of any folder by ID (metadata only NOT contents). Metadata includes id, type, name and some other field. Full list of fields get be checked at FileItemDTO object.\n\nThis issue affects Apache OpenMeetings: from 3.10 before 9.0.0.\n\nUsers are recommended to upgrade to version 9.0.0, which fixes the issue.","status":"published","published":"2026-04-09T15:52:50.77Z","modified":"2026-04-10T18:44:45.976Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-274"],"updated_at":"2026-11-02T14:20:07.609948Z"}],"euvd":[{"id":"EUVD-2026-20934","description":"Improper Handling of Insufficient Privileges vulnerability in Apache OpenMeetings.\n\nAny registered user can query web service with their credentials and get files/sub-folders of any folder by ID (metadata only NOT contents). Metadata includes id, type, name and some other field. Full list of fields get be checked at FileItemDTO object.\n\nThis issue affects Apache OpenMeetings: from 3.10 before 9.0.0.\n\nUsers are recommended to upgrade to version 9.0.0, which fixes the issue.","status":"published","published":"2026-04-09T15:52:50Z","modified":"2026-04-10T18:44:45Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T19:24:29.850635Z"}],"ghsa":[{"id":"GHSA-78cg-fc6c-w44w","title":"Apache OpenMeetings has an Improper Handling of Insufficient Privileges vulnerability","description":"Sny registered user can query web service with their credentials and get files/sub-folders of any folder by ID (metadata only NOT contents). Metadata includes id, type, name and some other field. Full list of fields get be checked at FileItemDTO object.\n\nThis issue affects Apache OpenMeetings: from 3.10 before 9.0.0.\n\nUsers are recommended to upgrade to version 9.0.0, which fixes the issue.","status":"published","published":"2026-04-09T18:31:26Z","modified":"2026-04-10T21:35:13Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-274"],"updated_at":"2026-11-02T14:39:53.087746Z"}],"nvd":[{"id":"CVE-2026-33005","description":"Improper Handling of Insufficient Privileges vulnerability in Apache OpenMeetings.\n\nAny registered user can query web service with their credentials and get files/sub-folders of any folder by ID (metadata only NOT contents). Metadata includes id, type, name and some other field. Full list of fields get be checked at FileItemDTO object.\n\nThis issue affects Apache OpenMeetings: from 3.10 before 9.0.0.\n\nUsers are recommended to upgrade to version 9.0.0, which fixes the issue.","status":"published","published":"2026-04-09T16:16:26.823Z","modified":"2026-10-26T21:10:00.17Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-274"],"updated_at":"2026-11-02T14:12:13.902911Z"}],"osv":[{"id":"CVE-2026-33005","title":"Apache OpenMeetings: Insufficient checks in FileWebService","description":"Improper Handling of Insufficient Privileges vulnerability in Apache OpenMeetings.\n\nAny registered user can query web service with their credentials and get files/sub-folders of any folder by ID (metadata only NOT contents). Metadata includes id, type, name and some other field. Full list of fields get be checked at FileItemDTO object.\n\nThis issue affects Apache OpenMeetings: from 3.10 before 9.0.0.\n\nUsers are recommended to upgrade to version 9.0.0, which fixes the issue.","status":"published","published":"2026-04-09T15:52:50.77Z","modified":"2026-11-08T02:47:36.58025568Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-274"],"updated_at":"2026-11-08T03:29:52.421856Z"},{"id":"GHSA-78cg-fc6c-w44w","title":"Apache OpenMeetings has an Improper Handling of Insufficient Privileges vulnerability","description":"Sny registered user can query web service with their credentials and get files/sub-folders of any folder by ID (metadata only NOT contents). Metadata includes id, type, name and some other field. Full list of fields get be checked at FileItemDTO object.\n\nThis issue affects Apache OpenMeetings: from 3.10 before 9.0.0.\n\nUsers are recommended to upgrade to version 9.0.0, which fixes the issue.","status":"published","published":"2026-04-09T18:31:26Z","modified":"2026-04-10T21:50:40.201702Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"},{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-274"],"updated_at":"2026-11-02T15:46:40.657155Z"}]}}