CVE-2026-55489: BigBlueButton: IDOR on BBB through /api/graphql via POST parameter "presentationId" leads to Authentication Bypass
BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton presenters could submit a presentationId through /api/graphql that identified a presentation belonging to another meeting. akka-bbb-apps/src/main/scala/org/bigbluebutton/core/apps/presentationpod/RemovePresentationPubMsgHdlr.scala did not verify the presentation's meeting identifier before deletion, allowing a presenter who knew the identifier to delete another meeting's presentation and disrupt its availability. This issue is fixed in version 3.0.29.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
BigBlueButtonto a version that resolves this vulnerability.Fixed in 3.0.29
Event History
Frequently Asked Questions
Who can exploit this issue?
A BigBlueButton presenter can exploit it if they know the presentationId of a presentation in another meeting. The attacker must be able to submit a request to /api/graphql.
Which deployments are affected?
BigBlueButton versions before 3.0.29 are affected. The issue is fixed in version 3.0.29.
What is the practical impact of successful exploitation?
An attacker can delete a presentation belonging to another meeting. This can disrupt the availability of that meeting's presentation content.