Loading story…
A high-severity access control flaw tracked as CVE-2026-63101 allows unauthenticated attackers to export complete group member rosters from Open Event Server through version 1.19.1. The vulnerability affects the group followers CSV export workflow and can expose sensitive membership data including email addresses, names, join dates, and user roles.
Attackers can brute-force sequential group IDs, submit requests to an unauthenticated CSV export POST endpoint, poll an unauthenticated task-status endpoint, and retrieve a download URL for the generated file. The issue is remotely exploitable and has been rated CVSS 3.1 7.5 and CVSS 4.0 8.7. Recommended remediation is to upgrade to Open Event Server 1.19.2 or later and enforce authentication checks on the affected endpoints.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
A missing authentication vulnerability affecting Open Event Server through version 1.19.1 was publicly disclosed. The flaw allows unauthenticated attackers to export group member rosters via the CSV export workflow, exposing data such as email addresses, names, join dates, and roles.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcevulncheck.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apache OpenMeetings disclosed a critical path traversal vulnerability, **CVE-2026-49488**, that allows a user with moderator rights in any room to read arbitrary files accessible to the operating system account running the server. The flaw affects versions **5.0.0 through before 9.1.0** and can be exploited through a crafted download request, potentially exposing sensitive local files including credentials, configuration data, and other secrets stored on the host. The issue is tracked internally as **`OPENMEETINGS-2821`** and was credited to researchers **follycat** and **Y0n3er**. Apache said the vulnerability is fixed in **OpenMeetings 9.1.0**, making upgrade the primary remediation for organizations using the web conferencing and collaboration platform.
Jul 14, 2026
OpenReplay fixed a critical stored cross-site scripting flaw, tracked as **`CVE-2026-55879`**, that affects versions **`1.24.0` before `1.25.0`** and can let an unauthenticated attacker take over dashboard accounts. The issue allows anyone with a public project key to submit malicious custom event names or page URLs that are stored by the platform and later rendered in the authenticated dashboard, where attacker-controlled JavaScript can execute in the dashboard origin, steal the session JWT from `localStorage`, and hijack user access. The vulnerability is rated **CVSS 9.3** and mapped to **`CWE-79`**. The remediation shipped in **OpenReplay `v1.25.0`** and was reflected in subsequent code changes that centralized output encoding for event read paths. The patch escapes event entries and nested property maps on the backend before returning data from `SearchEvents` and `GetEventByID`, and also hardens the frontend by escaping JSON shown in `EventDetailsModal`, replacing `innerHTML` with `textContent` in a text measurement helper, and adding a reusable HTML-escaping utility. Together, the changes indicate the flaw stemmed from unsanitized event content being inserted into the UI without proper output encoding.
Jul 11, 2026
Apache disclosed two moderate-severity vulnerabilities in **Apache OpenMeetings** that affect releases before `9.0.0`, including a credential exposure issue tracked as **CVE-2026-34020**. The flaw stems from the REST login endpoint sending usernames and passwords through HTTP `GET` query parameters, which can leave credentials exposed in browser history, logs, referrers, and other URL-handling systems. Apache linked the issue to internal ticket `OPENMEETINGS-2816` and fixed it in version `9.0.0`. Apache also disclosed **CVE-2026-33005**, an improper privilege-handling flaw in `FileWebService` that lets any authenticated user retrieve metadata for files and subfolders in arbitrary folders by ID. The exposed information includes fields such as `id`, `type`, and `name`, though not file contents. Both issues were credited to **4ra2n**, described as a code security AI agent, and Apache advised users to upgrade to **OpenMeetings 9.0.0** to remediate the vulnerabilities.
Jun 29, 2026