CVE-2026-33005

OVERVIEW CVE-2026-33005 is an improper privilege handling vulnerability in Apache OpenMeetings versions 3.10 through 8.x that allows any registered user to enumerate files and folders within the system. By querying web services with valid credentials, attackers can retrieve metadata (including file IDs, types, names, and other attributes) for any folder, though actual file contents remain inaccessible. This information disclosure vulnerability affects a wide range of OpenMeetings deployments prior to version 9.0.0. SEVERITY The vulnerability carries a CVSS 3.1 score of 4.3 (MEDIUM) with a network attack vector, low complexity, and low privilege requirements. The attack requires valid user credentials and carries minimal operational burden, but the impact is limited to confidentiality—attackers gain only metadata visibility with no ability to modify or delete data. The FAUCET risk score of 38.0/100 reflects moderate concern within the security community. EXPLOITATION STATUS There is no evidence of active exploitation, with the vulnerability absent from CISA's Known Exploited Vulnerabilities catalog and registering a minimal EPSS score of 0.00115. No public exploit code is currently documented, and community attention remains low. Organizations should prioritize patching based on their risk tolerance and operational timeline rather than immediate exploit threats, with upgrade to version 9.0.0 serving as the definitive remediation.