BigBlueButton CVE-2025-55200

Requires an authenticated low-privileged account within a BigBlueButton session (PR:L) whose username field the attacker fully controls, use of the Shared Notes feature to render that username, and - critically - a higher-privileged victim (e.g., an Admin) must open the Shared Notes page for the stored payload to fire (UI:R). Exploitation is limited by the need for session access/authentication, dependence on victim interaction, and the fix in 3.0.13 (bbb-pads v1.5.4) applying HTML-entity escaping to the username. There is no evidence of a non-default configuration requirement - Shared Notes is standard functionality - so the primary real-world limiters are the authentication and victim-view prerequisites, which make this better suited to targeted privilege escalation than mass exploitation.

This is a medium-severity (CVSS 5.4) stored XSS in BigBlueButton's Shared Notes feature, and all available signals are internally consistent, pointing to a genuine but non-urgent issue rather than a high-priority emergency. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) requires an authenticated low-privileged account (PR:L) plus victim interaction - a higher-privileged user must open the Shared Notes page (UI:R) - which substantially narrows the exploitation window. EPSS is low at 0.24% (15th percentile), there is no CISA KEV listing, and no public exploit was identified at time of analysis, all of which align with a low likelihood of widespread opportunistic exploitation. The scope change (S:C) and cross-privilege impact (a low-priv user executing JavaScript in an Admin's context) are the aggravating factors that explain the medium score despite only Low confidentiality/integrity impact and no availability impact. No signals conflict: low EPSS, absent KEV, and a vector demanding both authentication and a victim action all reinforce that this is a real-but-targeted privilege-escalation-flavored XSS that is appropriately patched rather than a drop-everything priority. Treat it as a standard patch-cycle item, prioritized somewhat higher for internet-facing education/webinar deployments where untrusted or self-registered participants can join sessions.

A low-privileged participant joins a BigBlueButton session and sets their username to a value containing a malicious JavaScript payload, then edits content in the Shared Notes feature so the username is rendered on the Shared Notes page. When an Admin or other higher-privileged user opens that page, the script executes in their authenticated browser context. No public exploit code was identified, but payload construction is straightforward given the confirmed stored-XSS sink in the username field (AV:N/AC:L).