Vulnerability · Published Aug 20, 2026 · Assigned by GitHub_M

CVE-2026-46682BigBlueButton: Blind SQL Injection AUTH (Moderator)

High 8.5

In plain English

A high-severity SQL injection in bigbluebutton from bigbluebutton. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).

Severity (CVSS 3.1)8.5High

Exploit odds (30 days)0.6%top 52.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, BigBlueButton allowed authenticated moderators to inject SQL through the meetingId and userId values used by refreshBreakoutRoomsVisibleForUsers in akka-bbb-apps/src/main/scala/org/bigbluebutton/core/db/BreakoutRoomUserDAO.scala. The method interpolated those values into breakout room visibility queries, allowing arbitrary SQL execution against the application database. This issue is fixed in version 3.0.23.

Affected products (as reported)

Vendor	Product	Versions
bigbluebutton	bigbluebutton	< 3.0.23

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

References

https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-gfv2-46v4-jvw5 x_refsource_CONFIRM
https://github.com/bigbluebutton/bigbluebutton/commit/3365e340e0c102de0f8ea007c05053b562b6fa2b x_refsource_MISC
https://github.com/bigbluebutton/bigbluebutton/releases/tag/v3.0.23 x_refsource_MISC