CVE-2026-55489

EUVD-2026-63683

20.08.2026, 22:17

BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton presenters could submit a presentationId through /api/graphql that identified a presentation belonging to another meeting. akka-bbb-apps/src/main/scala/org/bigbluebutton/core/apps/presentationpod/RemovePresentationPubMsgHdlr.scala did not verify the presentation's meeting identifier before deletion, allowing a presenter who knew the identifier to delete another meeting's presentation and disrupt its availability. This issue is fixed in version 3.0.29.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
GitHub_M	CNA	4.9 MEDIUM	NETWORK	HIGH	LOW	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:L

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
bigbluebutton	bigbluebutton	𝑥 < 3.0.29	CNA

Common Weakness Enumeration

CWE-639 - Authorization Bypass Through User-Controlled Key
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References

https://github.com/bigbluebutton/bigbluebutton/commit/c9e93f9af07b9661e286d101b83cbccb891c551f

https://github.com/bigbluebutton/bigbluebutton/releases/tag/v3.0.29

https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-jxpq-r3h3-p75g