BigBlueButton CVE-2026-55489

The attacker must hold an active presenter role in any BigBlueButton meeting on the target server - moderator or viewer roles alone are insufficient. The attacker must also know the presentationId (a server-assigned identifier) of a presentation belonging to a different concurrent meeting; this ID is not advertised publicly and requires either participation in the victim meeting, access to server logs, or enumeration via other means. The AC:H CVSS metric reflects this prerequisite. Exploitation is constrained to BigBlueButton instances running versions prior to 3.0.29. There are no additional configuration requirements - any default deployment of the affected version is susceptible once a presenter session is established and a foreign presentationId is known. The impact is limited to integrity and availability of the victim meeting's presentation content; no confidentiality loss or code execution is possible through this path.

The provided CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:L) scores 4.9 (Medium), which accurately reflects the real-world risk profile. AC:H captures the prerequisite that the attacker must obtain a presentationId from a different meeting - this ID is not publicly broadcast, so some reconnaissance or insider knowledge is required. PR:L correctly reflects that a presenter role is the minimum authentication threshold; anonymous users cannot exploit this. The Scope:Changed metric is appropriate because the impact falls outside the attacker's own meeting boundary, disrupting a separate victim meeting. No EPSS score was provided in the input, and no CISA KEV listing exists, consistent with the attack complexity and limited blast radius. The practical priority for most deployments is moderate: the vulnerability enables availability disruption and limited integrity loss rather than data exfiltration or code execution, and exploitation is gated on knowing a foreign presentationId. There is no indication of active or widespread exploitation. However, for multi-tenant hosted BigBlueButton environments serving many concurrent meetings, the cross-tenant sabotage potential elevates real-world concern beyond what the raw numerical score suggests.

A malicious presenter authenticated to Meeting A issues a crafted GraphQL mutation to /api/graphql supplying the presentationId of a document uploaded in Meeting B, which they obtained by attending or monitoring Meeting B's session. Because the server previously validated only the existence of the presentationId and not its meeting ownership, the presentation is permanently deleted from Meeting B, disrupting that meeting's participants without any visible alert to Meeting B's organizer. No public proof-of-concept code has been identified at time of analysis.