CVE-2026-33005: Apache OpenMeetings Improper Handling of Insufficient Privileges Vulnerability
Summary
CVE-2026-33005: Apache OpenMeetings has an Improper Handling of Insufficient Privileges vulnerability. Affects org.apache.openmeetings:openmeetings-parent versions >= 3.10, < 9.0.0. Fixed in 9.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache OpenMeetings is an open-source web conferencing software that enables users to conduct online meetings, webinars, and collaborative sessions. It provides features such as video conferencing, screen sharing, and document collaboration. However, certain versions of OpenMeetings are vulnerable to an issue that allows registered users to access metadata of files and sub-folders without proper authorization.
Vulnerability Detail
The vulnerability arises from improper handling of user privileges, allowing registered users to query the web service using their credentials. This enables them to retrieve metadata of files and sub-folders by their ID, which includes sensitive information such as ID, type, and name. Although the contents of the files are not accessible, the exposure of metadata can lead to unauthorized information disclosure and potential exploitation. This issue affects Apache OpenMeetings versions from 3.10 up to, but not including, 9.0.0.
How To Fix
Minimum fixed version
9.0.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict access to the web service for registered users until the upgrade can be performed. This can be done by modifying the access control settings in the application configuration.
Conclusion
In summary, CVE-2026-33005 is a moderate vulnerability in Apache OpenMeetings that allows unauthorized access to file metadata. Users are strongly advised to upgrade to version 9.0.0 to mitigate this risk. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for org.apache.openmeetings:openmeetings-parent →
FAQ
CVE-2026-33005 is a vulnerability in Apache OpenMeetings that allows registered users to access file metadata without proper authorization.
The vulnerability affects Apache OpenMeetings versions from 3.10 up to, but not including, 9.0.0.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerability can lead to unauthorized access to sensitive metadata, which may facilitate further attacks or information leakage.
To upgrade, modify your project's pom.xml file to include the dependency for version 9.0.0 of the openmeetings-parent package.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.openmeetings:openmeetings-parent.
