An insufficient privilege check in the FileWebService allows any authenticated user to query the metadata of any folder by its identifier. The returned data includes the folder’s id, type, name, and other fields defined in the FileItemDTO class, but it does not deliver the actual file contents. This issue enables an attacker to map the organization’s file and folder structure without executing code, and the weakness is classified as CWE‑274.

Apache OpenMeetings, maintained by the Apache Software Foundation, is vulnerable in all releases from version 3.10 up to, but not including, 9.0.0. Any installation that exposes the FileWebService to clients within this version range is affected.

The CVSS base score of 4.3 indicates moderate severity, and an EPSS score of less than 1 % suggests a low probability of exploitation in the current landscape. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires only that the user is authenticated; no higher privileges or special conditions are needed to traverse the folder tree via metadata. As a result, the primary risk is the disclosure of organizational file structures, which could aid subsequent targeted attacks, but it does not provide direct system compromise.