DNA View

CVE-2026-33005

Medium

Low Medium High Critical

4.3

CVSS Score

Published: Apr 09, 2026

Last Modified: Apr 15, 2026

CWE: CWE-274

Vulnerability Description

Improper Handling of Insufficient Privileges vulnerability in Apache OpenMeetings.

Any registered user can query web service with their credentials and get files/sub-folders of any folder by ID (metadata only NOT contents). Metadata includes id, type, name and some other field. Full list of fields get be checked at FileItemDTO object.

This issue affects Apache OpenMeetings: from 3.10 before 9.0.0.

Users are recommended to upgrade to version 9.0.0, which fixes the issue.

CVSS Metrics

Common Vulnerability Scoring System

Vector String:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Known Affected Software

26 configuration(s) from 1 vendor(s)

openmeetings

Version:

5.0.0

CPE:

cpe:2.3:a:apache:openmeetings:5.0.0:*:*:*:*:*:*:*

openmeetings

Version:

3.1.2

CPE:

cpe:2.3:a:apache:openmeetings:3.1.2:*:*:*:*:*:*:*

openmeetings

Version:

3.2.1

CPE:

cpe:2.3:a:apache:openmeetings:3.2.1:*:*:*:*:*:*:*

openmeetings

Version:

8.0.0

CPE:

cpe:2.3:a:apache:openmeetings:8.0.0:*:*:*:*:*:*:*

openmeetings

Version:

3.1.5

CPE:

cpe:2.3:a:apache:openmeetings:3.1.5:*:*:*:*:*:*:*

openmeetings

Version:

3.1.4

CPE:

cpe:2.3:a:apache:openmeetings:3.1.4:*:*:*:*:*:*:*

openmeetings

Version:

3.1.0

CPE:

cpe:2.3:a:apache:openmeetings:3.1.0:*:*:*:*:*:*:*

openmeetings

Version:

3.3.1

CPE:

cpe:2.3:a:apache:openmeetings:3.3.1:*:*:*:*:*:*:*

openmeetings

Version:

4.0.1

CPE:

cpe:2.3:a:apache:openmeetings:4.0.1:*:*:*:*:*:*:*

openmeetings

Version:

4.0.0

CPE:

cpe:2.3:a:apache:openmeetings:4.0.0:*:*:*:*:*:*:*

openmeetings

Version:

6.1.0

CPE:

cpe:2.3:a:apache:openmeetings:6.1.0:*:*:*:*:*:*:*

openmeetings

Version:

4.0.11

CPE:

cpe:2.3:a:apache:openmeetings:4.0.11:*:*:*:*:*:*:*

openmeetings

Version:

3.3.0

CPE:

cpe:2.3:a:apache:openmeetings:3.3.0:*:*:*:*:*:*:*

openmeetings

Version:

4.0.10

CPE:

cpe:2.3:a:apache:openmeetings:4.0.10:*:*:*:*:*:*:*

openmeetings

Version:

4.0.2

CPE:

cpe:2.3:a:apache:openmeetings:4.0.2:*:*:*:*:*:*:*

openmeetings

Version:

6.3.0

CPE:

cpe:2.3:a:apache:openmeetings:6.3.0:*:*:*:*:*:*:*

openmeetings

Version:

6.0.0

CPE:

cpe:2.3:a:apache:openmeetings:6.0.0:*:*:*:*:*:*:*

openmeetings

Version:

3.1.1

CPE:

cpe:2.3:a:apache:openmeetings:3.1.1:*:*:*:*:*:*:*

openmeetings

Version:

3.3.2

CPE:

cpe:2.3:a:apache:openmeetings:3.3.2:*:*:*:*:*:*:*

openmeetings

Version:

6.2.0

CPE:

cpe:2.3:a:apache:openmeetings:6.2.0:*:*:*:*:*:*:*

openmeetings

Version:

7.0.0

CPE:

cpe:2.3:a:apache:openmeetings:7.0.0:*:*:*:*:*:*:*

openmeetings

Version:

3.2.0

CPE:

cpe:2.3:a:apache:openmeetings:3.2.0:*:*:*:*:*:*:*

openmeetings

Version:

4.0.9

CPE:

cpe:2.3:a:apache:openmeetings:4.0.9:*:*:*:*:*:*:*

openmeetings

Version:

5.0.1

CPE:

cpe:2.3:a:apache:openmeetings:5.0.1:*:*:*:*:*:*:*

openmeetings

Version:

4.0.3

CPE:

cpe:2.3:a:apache:openmeetings:4.0.3:*:*:*:*:*:*:*

openmeetings

Version:

3.1.3

CPE:

cpe:2.3:a:apache:openmeetings:3.1.3:*:*:*:*:*:*:*

This vulnerability affects 26 software configuration(s). Ensure you patch all affected systems.

References & Resources

Severity Details

4.3

out of 10.0

Medium

Weakness Type (CWE)

CWE-274

Improper Handling of Insufficient Privileges

Description: The product does not handle or incorrectly handles when it has insufficient privileges to perform an operation, leading to resultant weaknesses.
Typical Severity: Medium
Abstraction Level: Base