Apache OpenMeetings 9.1.0 - High - Remote - IDOR - WHITEBOARD fileId plant then room file resource serves bytes
abraxaslabs.tech · github.com/abraxas · @abraxas_null · [email protected] · openmeetings-wb-fileid-idor
Class: IDOR Reach: Remote
Apache OpenMeetings 9.1.0. WHITEBOARD/PRESENTER CREATE_OBJ stores client JSON including any fileId. RoomResourceReference then serves those bytes if isAtWb sees that id. CVE-2026-49488 closed moderator fuid OS path read. This leftover is a numeric file id on the whiteboard.
Default public unmoderated rooms: first joiner is presenter.
| ID | no CVE yet |
| Class | IDOR |
| Reach | Remote (room presenter) |
| CWE | CWE-639 |
| CVSS | High: 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| Product | Apache OpenMeetings 9.1.0 |
| Auth | ROOM, first joiner of an unmoderated public room |
| License | GNU Affero GPL v3.0 |
| Lab | 127.0.0.1:18154 only |
| Method | Sink | Privilege |
|---|---|---|
Room WS CREATE_OBJ with victim fileId then GET /room/file/{id} | WbPanel.doActionWhiteboard + RoomResourceReference.getFileItem | Recon (lab-proven): bytes of another user's FileItem. Lab: PNG 57 bytes, witness in body, HTTP 200 image/png. |
Closed: CVE-2026-49488 validateLocation OS path. DOWNLOAD is still moderator-only. Group files still need group membership if not on WB.
cd lab
./run.sh
Last line: SUCCESS OPENMEETINGS-WB-FILEID-WITNESS
Suggested fix: CREATE_OBJ must reject a fileId the caller cannot read. isAtWb is not an ACL.
Abraxas Labs - https://abraxaslabs.tech - https://github.com/abraxas - https://x.com/abraxas_null - [email protected]
Vendor: [email protected]