EUVD-2026-63677Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
Moderator role maps to PR:L; S:C reflects database-tier scope change; I:L added because SQL injection may permit writes if the DB user has broader permissions than a read-only SELECT path implies.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, BigBlueButton allowed authenticated moderators to inject SQL through the meetingId and userId values used by refreshBreakoutRoomsVisibleForUsers in akka-bbb-apps/src/main/scala/org/bigbluebutton/core/db/BreakoutRoomUserDAO.scala. The method interpolated those values into breakout room visibility queries, allowing arbitrary SQL execution against the application database. This issue is fixed in version 3.0.23.
AnalysisAI
SQL injection in BigBlueButton's breakout room management exposes the application database to arbitrary query execution by authenticated moderators. Versions prior to 3.0.23 are affected via the refreshBreakoutRoomsVisibleForUsers method in BreakoutRoomUserDAO.scala, where meetingId and userId were interpolated directly into SQL using Scala's raw #$ string operator without parameterization. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires holding an authenticated moderator role within a BigBlueButton meeting instance; viewer-only participants and unauthenticated users cannot trigger this code path. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.5 with AV:N/AC:L/PR:L/UI:N/S:C/C:H captures the key risk drivers: the vulnerability is network-accessible with no special conditions, requires only moderator-level credentials, and carries a scope change (S:C) indicating the SQL injection reaches the underlying database beyond the application tier, with high confidentiality impact on that data store. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to BigBlueButton 3.0.23 or later, which is the vendor-confirmed fixed release available at https://github.com/bigbluebutton/bigbluebutton/releases/tag/v3.0.23 and documented in security advisory https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-gfv2-46v4-jvw5. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all BigBlueButton instances to identify those running versions prior to 3.0.23 and document affected deployments. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Bigbluebutton
View allBigBlueButton through 2.2.28 uses Ghostscript for processing of uploaded EPS documents, and consequently may be subject
BigBlueButton before 2.2.6 allows remote attackers to read arbitrary files because the presfilename (lowercase) value ca
The installation procedure in BigBlueButton before 2.2.28 (or earlier) uses ClueCon as the FreeSWITCH password, which al
An issue was discovered in BigBlueButton through 2.2.29. Rated high severity (CVSS 7.5), this vulnerability is remotely
The installation procedure in BigBlueButton before 2.2.28 (or earlier) exposes certain network services to external inte
BigBlueButton before 2.2.27 has an unsafe JODConverter setting in which LibreOffice document conversions can access exte
BigBlueButton before 2.2.5 allows remote attackers to obtain sensitive files via Local File Inclusion. Rated high severi
BigBlueButton versions 3.0.21 and below allow remote denial of service when ClamAV is configured following official docu
In BigBlueButton before 2.2.28 (or earlier), the client-side Mute button only signifies that the server should stop acce
BigBlueButton before 2.3 does not implement LibreOffice sandboxing. Rated medium severity (CVSS 6.5), this vulnerability
BigBlueButton before 2.2.7 allows remote authenticated users to read local files and conduct SSRF attacks via an uploade
In BigBlueButton before 2.2.28 (or earlier), uploaded presentations are sent to clients without a Content-Type header, w
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today