How severe is CVE-2026-33005?

CVE-2026-33005 has a CVSS 3.x base score of 4.3, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.

Is CVE-2026-33005 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (34th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-33005?

CVE-2026-33005 affects Apache Openmeetings. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-33005?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2026-33005 have an EU (EUVD) identifier?

Yes. CVE-2026-33005 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-20934.

When was CVE-2026-33005 published?

CVE-2026-33005 was published on 2026-04-09 and last updated on 2026-06-17.

CVE-2026-33005

CVE-2026-33005 is a medium-severity vulnerability in Apache Openmeetings with a CVSS 3.x base score of 4.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-274.

Key facts

Severity: Medium (CVSS 3.x base score 4.3)
EPSS exploit prediction: 0% (34th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-20934
Weakness: CWE-274
Affected product: Apache Openmeetings
Published: 2026-04-09
Last modified: 2026-06-17

Description

Improper Handling of Insufficient Privileges vulnerability in Apache OpenMeetings. Any registered user can query web service with their credentials and get files/sub-folders of any folder by ID (metadata only NOT contents). Metadata includes id, type, name and some other field. Full list of fields get be checked at FileItemDTO object. This issue affects Apache OpenMeetings: from 3.10 before 9.0.0. Users are recommended to upgrade to version 9.0.0, which fixes the issue.

Frequently asked questions

What is CVE-2026-33005?: Improper Handling of Insufficient Privileges vulnerability in Apache OpenMeetings. Any registered user can query web service with their credentials and get files/sub-folders of any folder by ID (metadata only NOT contents). Metadata includes id, type, name and some other field. Full list of fields get be checked at FileItemDTO object. This issue affects Apache OpenMeetings: from 3.10 before 9.0.0. Users are recommended to upgrade to version 9.0.0, which fixes the issue.
How severe is CVE-2026-33005?: CVE-2026-33005 has a CVSS 3.x base score of 4.3, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.
Is CVE-2026-33005 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (34th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-33005?: CVE-2026-33005 affects Apache Openmeetings. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-33005?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-33005 have an EU (EUVD) identifier?: Yes. CVE-2026-33005 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-20934.
When was CVE-2026-33005 published?: CVE-2026-33005 was published on 2026-04-09 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:apache:openmeetings:*:*:*:*:*:*:*:*

More vulnerabilities in Apache Openmeetings

CVE-2017-7664 — Critical (CVSS 10.0): Uploaded XML documents were not correctly validated in Apache OpenMeetings 3.1.0.
CVE-2024-54676 — Critical (CVSS 9.8): Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.1.0 before 8.0.0 Description:…
CVE-2023-28326 — Critical (CVSS 9.8): Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.0.0 before 7.0.0 Description:…
CVE-2016-8736 — Critical (CVSS 9.8): Apache OpenMeetings before 3.1.2 is vulnerable to Remote Code Execution via RMI deserialization attack.
CVE-2017-7673 — Critical (CVSS 9.8): Apache OpenMeetings 1.0.0 uses not very strong cryptographic storage, captcha is not used in registration and forget…
CVE-2017-7681 — High (CVSS 8.8): Apache OpenMeetings 1.0.0 is vulnerable to SQL injection. This allows authenticated users to modify the structure of…

All CVEs affecting Apache Openmeetings →

Other CWE-274 vulnerabilities

CVE-2025-20156 — Critical (CVSS 9.9): A vulnerability in the REST API of Cisco Meeting Management could allow a remote, authenticated attacker with low…
CVE-2024-0105 — High (CVSS 8.9): NVIDIA ConnectX Firmware contains a vulnerability where an attacker may cause an improper handling of insufficient…
CVE-2024-0106 — High (CVSS 8.7): NVIDIA ConnectX Host Firmware for the BlueField Data Processing Unit (DPU) contains a vulnerability where an attacker…
CVE-2023-35928 — High (CVSS 8.4): Nextcloud Server is a space for data storage on Nextcloud, a self-hosted productivity playform. In NextCloud Server…
CVE-2024-21648 — High (CVSS 8.0): XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The rollback…
CVE-2020-24676 — High (CVSS 7.8): In Symphony Plus Operations and Symphony Plus Historian, some services can be vulnerable to privilege escalation…

Browse all CWE-274 vulnerabilities →