CVE-2026-49488: openmeetings from 5.0.0 (inclusive), before 9.1.0 (exclusive); +1 more affected products

Affected technology

openmeetings · from 5.0.0 (inclusive), before 9.1.0 (exclusive)
apache

Apache OpenMeetings · 5.0.0 to before 9.1.0
Apache Software Foundation

Component: Not specified by the source

Attack conditions (NVD, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

An attacker with moderator rights in any room can read arbitrary files accessible to the OS account running the OM server, including credentials and secrets, via a crafted download request. NVD’s CVSS 3.1 assessment (base score 6.5/10) rates confidentiality impact as high; integrity and availability impact as none. Source advisory’s CVSS 3.1 assessment (base score 6.5/10) rates confidentiality impact as high; integrity and availability impact as none.