CVE-2026-33005

{
  "id": "CVE-2026-33005",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-09T16:16:26.823",
  "lastModified": "2026-10-26T21:10:00.170",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Handling of Insufficient Privileges vulnerability in Apache OpenMeetings.\n\nAny registered user can query web service with their credentials and get files/sub-folders of any folder by ID (metadata only NOT contents). Metadata includes id, type, name and some other field. Full list of fields get be checked at FileItemDTO object.\n\nThis issue affects Apache OpenMeetings: from 3.10 before 9.0.0.\n\nUsers are recommended to upgrade to version 9.0.0, which fixes the issue."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de Manejo Inadecuado de Privilegios Insuficientes en Apache OpenMeetings.\n\nCualquier usuario registrado puede consultar el servicio web con sus credenciales y obtener archivos/subcarpetas de cualquier carpeta por ID (solo metadatos, NO el contenido). Los metadatos incluyen id, tipo, nombre y algún otro campo. La lista completa de campos se puede consultar en el objeto FileItemDTO.\n\nEste problema afecta a Apache OpenMeetings: desde 3.10 antes de 9.0.0.\n\nSe recomienda a los usuarios actualizar a la versión 9.0.0, que corrige el problema."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache OpenMeetings",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "3.1.0",
              "lessThan": "9.0.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-10T18:44:03.788543Z",
          "id": "CVE-2026-33005",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-274"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apache:openmeetings:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "3.1.0",
              "versionEndExcluding": "9.0.0",
              "matchCriteriaId": "DDF05947-6FA6-438F-83E5-F484EC43F6B2"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://lists.apache.org/thread/pttoprd628g3xr6lpp3bm1z8m3z8t4p7",
      "source": "[email protected]",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://openmeetings.apache.org/openmeetings-db/apidocs/org.apache.openmeetings.db/org/apache/openmeetings/db/dto/file/FileItemDTO.html",
      "source": "[email protected]",
      "tags": [
        "Product"
      ]
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/04/09/10",
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ]
    }
  ]
}