PT-2026-31639

CVE-2026-33005

Published

2026-04-09

Updated

2026-04-10

Description by

CVSS 3.1

4.3

Medium

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache OpenMeetings versions prior to 9.0.0

Description A registered user can query a web service with their credentials and retrieve metadata (id, type, name, and other fields from the FileItemDTO object) for files and sub-folders of any folder by ID. This is due to improper handling of insufficient privileges.

Recommendations Upgrade to version 9.0.0.

Exploitability

Exploit

Fix

Researchers

4Ra2N

Vendors

Affected products

Weakness enumeration

CWE-274: Improper Handling of Insufficient Privileges

Related identifiers

CVE-2026-33005