Read the docs
TI-2026-25453 Aliases CVE-2026-33005GHSA-78cg-fc6c-w44w

Apache OpenMeetings: Insufficient checks in FileWebService

Priority LOW 20CWE-274Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub.

Summary

Improper Handling of Insufficient Privileges vulnerability in Apache OpenMeetings. Any registered user can query web service with their credentials and get files/sub-folders of any folder by ID (metadata only NOT contents). Metadata includes id, type, name and some other field. Full list of fields get be checked at FileItemDTO object. This issue affects Apache OpenMeetings: from 3.10 before 9.0.0. Users are recommended to upgrade to version 9.0.0, which fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00425 37th percentileScored 2026-11-07
Fix Fixed Apache OpenMeetings (Apache Software Foundation): 9.0.0org.apache.openmeetings:openmeetings-parent (Maven): 9.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache OpenMeetings3.1.0 to before 9.0.09.0.0Patch availableCNA
—org.apache.openmeetings:openmeetings-parent (Maven)3.10 to before 9.0.09.0.0Patch availableGHSA-78cg-fc6c-w44w
  • Apache OpenMeetings VendorApache Affected 3.1.0 to before 9.0.0 Fixed in 9.0.0 Patch available CNA
  • org.apache.openmeetings:openmeetings-parent (Maven) Vendor— Affected 3.10 to before 9.0.0 Fixed in 9.0.0 Patch available GHSA-78cg-fc6c-w44w

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:openmeetings:*:*:*:*:*:*:*:*3.1.0 to before 9.0.0VulnerableApache
  • cpe:2.3:a:apache:openmeetings:*:*:*:*:*:*:*:* Versions 3.1.0 to before 9.0.0 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache OpenMeetings (Apache Software Foundation) Fixed in 9.0.0
  • Fix · GHSA-78cg-fc6c-w44w org.apache.openmeetings:openmeetings-parent (Maven) Fixed in 9.0.0 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Apache OpenMeetings 9.0.0

    3 records Highest priority Priority HIGH 1 HIGH, 2 LOW

    Other records, highest priority first

    • TI-2026-26346 Apache OpenMeetings: Login Credentials Passed via GET Query ParametersPriority HIGH 72
    • TI-2026-25683 Apache OpenMeetings: Hardcoded Remember-Me Cookie Encryption Key and SaltPriority LOW 39
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33005
  2. 2026-10-03 Alias added: GHSA-78cg-fc6c-w44w
  3. 2026-10-16 EPSS moved to the 50th–90th percentile
  4. 2026-10-25 EPSS moved to the below the 50th percentile

References

Advisory 3

Other 2

  • TI-2024-36639 Apache OpenMeetings: Deserialisation of untrusted data in cluster mode CVSS 3.1CRITICAL 9.8
  • TI-2026-26346 Apache OpenMeetings: Login Credentials Passed via GET Query Parameters CVSS 3.1HIGH 7.5
  • TI-2020-10927 Attackers can use public NetTest web service of Apache OpenMeetings 4.0.0-5.0.0 to organize denial of service attack. CVSS 3.1HIGH 7.5
  • TI-2016-00702 Directory traversal vulnerability in the Import/Export System Backups functionality in… CVSS 3.0MEDIUM 6.5
  • TI-2023-12874 Apache OpenMeetings: allows user impersonation CVSS 3.1CRITICAL 9.8
  • TI-2016-07193 Apache OpenMeetings before 3.1.2 is vulnerable to Remote Code Execution via RMI deserialization attack. CVSS 3.0CRITICAL 9.8
See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences