Security Advisory

CVE-2026-46682

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-08-20 21:33:56

Last updated 2026-08-21 21:45:22

Assigner GitHub_M

CVSS score 8.5

State PUBLISHED

Description

BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, BigBlueButton allowed authenticated moderators to inject SQL through the meetingId and userId values used by refreshBreakoutRoomsVisibleForUsers in akka-bbb-apps/src/main/scala/org/bigbluebutton/core/db/BreakoutRoomUserDAO.scala. The method interpolated those values into breakout room visibility queries, allowing arbitrary SQL execution against the application database. This issue is fixed in version 3.0.23.

← Browse all CVEs View on cve.org ↗