This vulnerability in Apache OpenMeetings (CVE-2026-33005) arises from improper handling of insufficient privileges (CWE-274). Registered users can query the web service to obtain metadata of any folder's files and sub-folders by ID, regardless of their authorization level. The metadata includes file identifiers, types, names, and other fields defined in the FileItemDTO object, but does not expose file contents. The affected versions range from 3.1.0 up to but not including 9.0.0. The vendor recommends upgrading to version 9.0.0 to remediate this issue.

The vulnerability allows unauthorized disclosure of file and folder metadata to any registered user. While the actual file contents are not exposed, the leakage of metadata could aid an attacker in reconnaissance or mapping the file structure within the application. There is no indication of impact on integrity or availability. The CVSS score is 4.3 (medium), reflecting limited confidentiality impact with no integrity or availability impact.

Users should upgrade Apache OpenMeetings to version 9.0.0 or later, where this vulnerability is fixed. No other official remediation or temporary fix is documented. Patch status is not explicitly confirmed in the advisory, but the vendor recommendation to upgrade to 9.0.0 indicates an official fix is available in that version.