PT-2026-31639 · Apache · Apache Openmeetings

4Ra2N · Published 2026-04-09 · Updated 2026-04-10 · CVE-2026-33005

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache OpenMeetings versions prior to 9.0.0

Description A registered user can query a web service with their credentials and retrieve metadata (id, type, name, and other fields from the FileItemDTO object) for files and sub-folders of any folder by ID. This is due to improper handling of insufficient privileges.

Recommendations Upgrade to version 9.0.0.

Fix

Weakness Enumeration

CWE-274

Related Identifiers

CVE-2026-33005

GHSA-78CG-FC6C-W44W

Affected Products

Apache Openmeetings

References · 9

• https://lists.apache.org/thread/pttoprd628g3xr6lpp3bm1z8m3z8t4p7 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-78cg-fc6c-w44w · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33005 · Security Note
• https://github.com/apache/openmeetings · Note
• https://openmeetings.apache.org/openmeetings-db/apidocs/org.apache.openmeetings.db/org/apache/openmeetings/db/dto/file/FileItemDTO.html · Note
• https://twitter.com/VulmonFeeds/status/2042313457832194424 · Twitter Post
• https://twitter.com/oss_security/status/2042429050954666419 · Twitter Post
• http://openwall.com/lists/oss-security/2026/04/09/10 · Note
• https://twitter.com/CVEnew/status/2042302804380041238 · Twitter Post