Sign in
Deutsch English Español Polski
Medium

Apache OpenMeetings has an Improper Handling of Insufficient Privileges vulnerability

  • Disclosed: 09.04.2026
  • Updated: 11.10.2026 12:22

Sny registered user can query web service with their credentials and get files/sub-folders of any folder by ID (metadata only NOT contents). Metadata includes id, type, name and some other field. Full list of fields get be checked at FileItemDTO object.

This issue affects Apache OpenMeetings: from 3.10 before 9.0.0.

Users are recommended to upgrade to version 9.0.0, which fixes the issue.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Java / Kotlin (Maven) org.apache.openmeetings:openmeetings-parent >= 3.10, < 9.0.0 9.0.0

References

CVSS score 4.3/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness (CWE)
CWE-274
Platform
Java / Kotlin (Maven)
Package
org.apache.openmeetings:openmeetings-parent
Disclosed
09.04.2026
Updated
11.10.2026 12:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-78cg-fc6c-w44w - CC BY 4.0

Vulnerability history: org.apache.openmeetings:openmeetings-parent

All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (25) in the archive
Total entries
25
First → latest
06.2021 04.2026
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • Critical 5
  • High 14
  • Medium 6

Disclosures per year

Severity:
  1. Apache OpenMeetings Uses GET Request Method With Sensitive Query Strings
    High · 7.5 CVE-2026-34020 >= 3.1.3, < 9.0.0 9.0.0
  2. Apache OpenMeetings has an Improper Handling of Insufficient Privileges vulnerability this entry
    Medium · 4.3 CVE-2026-33005 >= 3.10, < 9.0.0 9.0.0
  3. Apache OpenMeetings Uses Hard-coded Cryptographic Key
    High · 7.5 CVE-2026-33266 >= 6.1.0, < 9.0.0 9.0.0
  4. Apache OpenMeetings vulnerable to Deserialization of Untrusted Data
    Critical CVE-2024-54676 >= 2.1.0, < 8.0.0 8.0.0
  5. Apache OpenMeetings Improper Authentication vulnerability
    High · 8.1 CVE-2023-29032 >= 3.1.3, < 7.1.0 7.1.0
  6. Apache OpenMeetings vulnerable to remote code execution via null-bye injection
    High · 7.2 CVE-2023-29246 >= 2.0.0, < 7.1.0 7.1.0
  7. Apache OpenMeetings missing authentication and can allow user impersonation
    Critical · 9.8 CVE-2023-28326 >= 2.0.0, < 7.0.0 7.0.0
  8. Apache OpenMeetings displays Tomcat version and detailed error stack trace
    High · 7.5 CVE-2017-7683 >= 1.0.0, < 3.3.0 3.3.0
  9. Apache OpenMeetings vulnerable to SQL injection
    High · 8.8 CVE-2017-7681 >= 1.0.0, < 3.3.0 3.3.0
  10. Apache OpenMeetings vulnerable to Cross-Site Request Forgery
    High · 8.8 CVE-2017-7666 >= 1.0.0, < 3.3.0 3.3.0
  11. Apache OpenMeetings does not correctly validate uploaded XML documents
    Critical · 10.0 CVE-2017-7664 >= 3.1.0, < 3.3.0 3.3.0
  12. Apache OpenMeetings allows remote attackers to read arbitrary files by attempting to upload a file
    High · 7.5 CVE-2016-2164 < 3.1.1 3.1.1
  13. Apache OpenMeetings RCE
    Critical · 9.8 CVE-2016-8736 < 3.1.2 3.1.2
  14. Apache OpenMeetings vulnerable to Uncontrolled Resource Consumption
    High · 7.5 CVE-2017-7684 >= 1.0.0, < 3.3.0 3.3.0
  15. Apache OpenMeetings updates user password in insecure manner
    High · 7.5 CVE-2017-7688 >= 1.0.0, < 3.3.0 3.3.0
  16. Apache OpenMeetings allows flash content to be loaded from untrusted domains
    High · 7.5 CVE-2017-7680 >= 1.0.0, < 3.3.0 3.3.0
  17. Apache OpenMeetings vulnerable to parameter manipulation attacks
    High · 8.2 CVE-2017-7682 >= 3.2.0, < 3.3.0 3.3.0
  18. Apache OpenMeetings has Inadequate Encryption Strength
    Critical · 9.8 CVE-2017-7673 >= 1.0.0, < 3.3.0 3.3.0
  19. Denial of service in Apache OpenMeetings
    High · 7.5 CVE-2020-13951 >= 4.0.0, < 5.1.0 5.1.0
  20. Uncontrolled Resource Consumption in Apache OpenMeetings server
    High · 7.5 CVE-2021-27576 >= 4.0.0, < 6.0.0 6.0.0

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.