{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33005", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-03-17T16:01:03.395Z", "datePublished": "2026-04-09T15:52:50.770Z", "dateUpdated": "2026-04-09T16:29:20.600Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Apache OpenMeetings", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "9.0.0", "status": "affected", "version": "3.1.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "4ra2n (A code security AI agent)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Improper Handling of Insufficient Privileges vulnerability in Apache OpenMeetings.</p><p>Any registered user can query web service with their credentials and get files/sub-folders of any folder by ID (metadata only NOT contents). Metadata includes id, type, name and some other field. Full list of fields get be checked at&nbsp;FileItemDTO&nbsp;object.</p><p>This issue affects Apache OpenMeetings: from 3.10 before 9.0.0.</p><p>Users are recommended to upgrade to version 9.0.0, which fixes the issue.</p>"}], "value": "Improper Handling of Insufficient Privileges vulnerability in Apache OpenMeetings.\n\nAny registered user can query web service with their credentials and get files/sub-folders of any folder by ID (metadata only NOT contents). Metadata includes id, type, name and some other field. Full list of fields get be checked at\u00a0FileItemDTO\u00a0object.\n\nThis issue affects Apache OpenMeetings: from 3.10 before 9.0.0.\n\nUsers are recommended to upgrade to version 9.0.0, which fixes the issue."}], "metrics": [{"other": {"content": {"text": "moderate"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-274", "description": "CWE-274 Improper Handling of Insufficient Privileges", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-04-09T15:52:50.770Z"}, "references": [{"tags": ["technical-description"], "url": "https://openmeetings.apache.org/openmeetings-db/apidocs/org.apache.openmeetings.db/org/apache/openmeetings/db/dto/file/FileItemDTO.html"}, {"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/pttoprd628g3xr6lpp3bm1z8m3z8t4p7"}], "source": {"defect": ["OPENMEETINGS-2812"], "discovery": "EXTERNAL"}, "title": "Apache OpenMeetings: Insufficient checks in FileWebService", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/04/09/10"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-04-09T16:29:20.600Z"}}]}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Handling of Insufficient Privileges vulnerability in Apache OpenMeetings.\n\nAny registered user can query web service with their credentials and get files/sub-folders of any folder by ID (metadata only NOT contents). Metadata includes id, type, name and some other field. Full list of fields get be checked at\u00a0FileItemDTO\u00a0object.\n\nThis issue affects Apache OpenMeetings: from 3.10 before 9.0.0.\n\nUsers are recommended to upgrade to version 9.0.0, which fixes the issue."}], "id": "CVE-2026-33005", "lastModified": "2026-04-09T17:16:24.853", "metrics": {}, "published": "2026-04-09T16:16:26.823", "references": [{"source": "security@apache.org", "url": "https://lists.apache.org/thread/pttoprd628g3xr6lpp3bm1z8m3z8t4p7"}, {"source": "security@apache.org", "url": "https://openmeetings.apache.org/openmeetings-db/apidocs/org.apache.openmeetings.db/org/apache/openmeetings/db/dto/file/FileItemDTO.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/04/09/10"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-274"}], "source": "security@apache.org", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.1.0,9.0.0)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Apache OpenMeetings", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "openmeetings", "vendor": "apache"}], "analysis": {"en": {"generated_at": "2026-04-09T17:23:56.582262+00:00", "value": {"mitigation_remediation": ["Upgrade Apache OpenMeetings to version 9.0.0 or later to eliminate the vulnerability."], "summary": {"action": "Patch", "impact": "Unauthorized information disclosure via metadata"}, "threat_synthesis": {"affected_systems": "The flaw applies to Apache OpenMeetings versions earlier than 9.0.0, including all releases 3.10 and later up to, but not including, 9.0.0. Logically, any deployment of Apache OpenMeetings that relies on the default installation of the FileWebService component is vulnerable until upgraded.", "description_and_impact": "Apache OpenMeetings allows any authenticated user to call a web service that returns metadata, such as identifiers, types, names, and other fields, for files and sub\u2011folders by specifying a folder ID. The vulnerability stems from insufficient privilege checks before providing this metadata, classified as CWE\u2011274. This enables users to learn about resources they should not be aware of, exposing sensitive organizational structure, but does not provide actual file contents.", "risk_and_exploitability": "The CVSS base score is not explicitly stated, but the loophole allows authenticated users to enumerate directory structures across the platform. Attackers would need only legitimate login credentials, and the service is exposed over the network; thus the attack vector is inferred to be remote over HTTP/HTTPS. EPSS data is unavailable, and the flaw is not listed in the CISA KEV catalog, suggesting lower likelihood of widespread exploitation, though the potential for internal reconnaissance and data leakage remains significant."}}}}, "created": "2026-04-10T08:53:08.098662+00:00", "updated": "2026-04-10T09:32:20.681996+00:00", "vendors": ["apache", "apache$PRODUCT$openmeetings"]}