CVE-2026-46682 bigbluebutton CVE debrief

Who should care

BigBlueButton users and administrators, especially those with exposed or internet-facing instances, should be aware of this vulnerability. They need to assess their deployments for exposure, update to version 3.0.23 or later, and implement additional monitoring and compensating controls as necessary. Security teams and vulnerability management teams should prioritize this update and review system logs for potential exploitation attempts.

Technical summary

BigBlueButton versions before 3.0.23 contain a SQL injection vulnerability in the refreshBreakoutRoomsVisibleForUsers method. Authenticated moderators can inject arbitrary SQL, allowing execution against the application database. This issue arises from the interpolation of meetingId and userId values into breakout room visibility queries without proper sanitization. The vulnerability can be mitigated by updating to version 3.0.23 or later, restricting access to authenticated moderators, and monitoring for suspicious database activity.

Defensive priority

High priority to update BigBlueButton to version 3.0.23 or later.

Recommended defensive actions

• Update BigBlueButton to version 3.0.23 or later
• Restrict access to authenticated moderators
• Monitor for suspicious database activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

Evidence from official sources indicates a SQL injection vulnerability in BigBlueButton versions before 3.0.23. Limited details are available on exploitability and affected scope. To verify, defenders should review the official advisory and assess their deployments for exposure. This involves checking version numbers, network exposure, and existing mitigations. Additionally, defenders should monitor for suspicious database activity and review system logs for potential exploitation attempts.

Official resources