This vulnerability in Apache OpenMeetings allows any authenticated user to access metadata information of files and sub-folders within any folder by querying the web service with their credentials. The exposed metadata includes identifiers, types, names, and additional fields but excludes file contents. The flaw is due to improper handling of insufficient privileges, classified under CWE-274. Affected versions range from 3.10 up to but not including 9.0.0. The vendor has addressed the issue in version 9.0.0.

The impact is limited to unauthorized disclosure of metadata about files and folders within the system to any registered user. No file contents are exposed. This could potentially aid an attacker in reconnaissance or mapping the file structure but does not directly expose sensitive file data. There are no known exploits in the wild at this time.

Users are recommended to upgrade Apache OpenMeetings to version 9.0.0, which fixes this vulnerability. No other official remediation or temporary fixes are documented. Patch status is not explicitly confirmed beyond the recommendation to upgrade; therefore, check the vendor advisory for the latest remediation guidance.