PUBLISHED
2026-04-09 16:16
MODIFIED
2026-04-09 16:16
EPSS (Prob. Exploit)
0.65%
Top 49.5%
> DESCRIPTION
Improper Handling of Insufficient Privileges vulnerability in Apache OpenMeetings.
Any registered user can query web service with their credentials and get files/sub-folders of any folder by ID (metadata only NOT contents). Metadata includes id, type, name and some other field. Full list of fields get be checked at FileItemDTO object.
This issue affects Apache OpenMeetings: from 3.10 before 9.0.0.
Users are recommended to upgrade to version 9.0.0, which fixes the issue.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-274: Improper Handling of Insufficient Privileges - The product does not handle or incorrectly handles when it has insufficient privileges to perform an operation.
> GITHUB SECURITY ADVISORY
GHSA-78cg-fc6c-w44w
MODERATE
Apache OpenMeetings has an Improper Handling of Insufficient Privileges vulnerability
AFFECTED PACKAGES:
MAVEN / org.apache.openmeetings:openmeetings-parent
>= 3.10, < 9.0.0
Fixed in: 9.0.0
> HISTORIQUE DES MODIFICATIONS
Première apparition
09/04/2026 16:16
Source: NVD
📊
ENRICHISSEMENT
01/11/2026 06:59
CWE
Champ modifié: Description CWE
Ancienne valeur:
CWE-274: Improper Handling of Insufficient Privileges - The product does not handle or incorrectly handles when it has insufficient privileges to perform an operation, leading to resultant weaknesses.
Nouvelle valeur:
CWE-274: Improper Handling of Insufficient Privileges - The product does not handle or incorrectly handles when it has insufficient privileges to perform an operation.
📊
ENRICHISSEMENT
01/05/2026 06:01
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-274: Improper Handling of Insufficient Privileges - The product does not handle or incorrectly handles when it has insufficient privileges to perform an operation, leading to resultant weaknesses.
Total des modifications: 2
Dernière mise à jour: 1 week ago