CVE-2026-46682: BigBlueButton: Blind SQL Injection AUTH (Moderator)
BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, BigBlueButton allowed authenticated moderators to inject SQL through the meetingId and userId values used by refreshBreakoutRoomsVisibleForUsers in akka-bbb-apps/src/main/scala/org/bigbluebutton/core/db/BreakoutRoomUserDAO.scala. The method interpolated those values into breakout room visibility queries, allowing arbitrary SQL execution against the application database. This issue is fixed in version 3.0.23.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
BigBlueButtonto a version that resolves this vulnerability.Fixed in 3.0.23
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs to be authenticated as a BigBlueButton moderator. No user interaction is required, and the vulnerable inputs are the meetingId and userId values used when refreshing breakout room visibility.
Which deployments are affected?
BigBlueButton versions prior to 3.0.23 are affected. The provided information does not identify any configuration requirement or mitigation that disables the vulnerable code path.
What is the impact of successful exploitation?
A malicious authenticated moderator can inject SQL into breakout room visibility queries and execute arbitrary SQL against the application database. This can expose confidential database data and may cause limited availability impact.
What should be done to remediate the issue?
Upgrade BigBlueButton to version 3.0.23, which fixes the vulnerability. If an immediate upgrade is not possible, restrict moderator access to trusted users because moderator authentication is required for exploitation.