BigBlueButton CVE-2026-46682

Exploitation requires holding an authenticated moderator role within a BigBlueButton meeting instance; viewer-only participants and unauthenticated users cannot trigger this code path. The vulnerability is activated when the refreshBreakoutRoomsVisibleForUsers method is invoked during breakout room visibility refresh operations - a function accessible to any moderator during an active meeting. The injection payload must be embedded in the meetingId or userId parameter values passed to this method. The limiting factor is the PR:L (moderator) authentication requirement: anonymous users, guests without moderator rights, and standard attendees are excluded. However, in deployments where moderator status is freely granted to participants or where users can self-promote, the effective attack surface is substantially broader than a high-privilege requirement would imply. No specific non-default configuration, platform restriction, or version-specific feature flag is required beyond having the breakout rooms feature in active use.

The CVSS 8.5 with AV:N/AC:L/PR:L/UI:N/S:C/C:H captures the key risk drivers: the vulnerability is network-accessible with no special conditions, requires only moderator-level credentials, and carries a scope change (S:C) indicating the SQL injection reaches the underlying database beyond the application tier, with high confidentiality impact on that data store. No EPSS score was provided in this input, so probabilistic exploitation likelihood cannot be independently quantified. No KEV listing and no reported POC exist at time of analysis, which reduces urgency relative to vulnerabilities with confirmed active exploitation. However, the PR:L requirement - a moderator role - is not a strong barrier in many BigBlueButton deployments where meeting hosts routinely self-elevate or share moderator credentials, which meaningfully widens the practical attack surface. The A:L (low availability) metric suggests secondary disruption is possible but is not the primary risk vector. The S:C and C:H combination indicates potential for full-database read access across meeting, user, and session data - not scoped to the attacker's own meeting - making this a meaningful data-exposure risk for any operator running multi-tenant or multi-institution deployments.

An authenticated moderator of a BigBlueButton session crafts a meetingId or userId value containing SQL metacharacters - for example, a UNION SELECT payload - and triggers a breakout room visibility refresh operation. Because the refreshBreakoutRoomsVisibleForUsers method used raw Scala string interpolation to embed these values directly into the WHERE clause, the payload is executed verbatim against the application database, enabling the attacker to extract data from other meetings, user records, or session tokens stored in the database. No public POC has been identified at time of analysis.