PatchSiren cyber security CVE debrief
CVE-2026-55489 bigbluebutton CVE debrief
BigBlueButton is an open-source virtual classroom. A vulnerability in BigBlueButton allowed presenters to submit a presentationId through /api/graphql that identified a presentation belonging to another meeting. The akka-bbb-apps/src/main/scala/org/bigbluebutton/core/apps/presentationpod/RemovePresentationPubMsgHdlr.scala file did not verify the presentation's meeting identifier before deletion, allowing a presenter who knew the identifier to delete another meeting's presentation and disrupt its availability. This issue is fixed in version 3.0.29. The CVE record was published on 2026-08-20T22:17:22.200Z and has not been modified since then. The NVD entry is currently MEDIUM. Limited detail is available on affected scope and potential impact. BigBlueButton users and administrators should verify their installations and apply patches if necessary.
- Vendor
- bigbluebutton
- Product
- Unknown
- CVSS
- MEDIUM 4.9
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-08-20
- Original CVE updated
- 2026-08-21
- Advisory published
- 2026-08-20
- Advisory updated
- 2026-08-21
Who should care
BigBlueButton users and administrators should be aware of this vulnerability and take steps to protect their installations. The NVD entry is currently MEDIUM. BigBlueButton users and administrators should verify their installations and apply patches if necessary.
Technical summary
BigBlueButton presenters can submit a presentationId through /api/graphql that identifies a presentation belonging to another meeting. The akka-bbb-apps/src/main/scala/org/bigbluebutton/core/apps/presentationpod/RemovePresentationPubMsgHdlr.scala file did not verify the presentation's meeting identifier before deletion, allowing a presenter who knew the identifier to delete another meeting's presentation and disrupt its availability. This issue is fixed in version 3.0.29. The CVE record was published on 2026-08-20T22:17:22.200Z and has not been modified since then.
Defensive priority
Medium-priority defensive actions are required to address this issue.
Recommended defensive actions
- Verify BigBlueButton version and apply patch 3.0.29 if vulnerable
- Restrict access to presentation deletion functionality
- Monitor for unusual presentation deletion activity
- Review compensating controls for exposed systems while remediation is scheduled and verified
- Check relevant monitoring, detection, and logs for exposed assets that need extra review
- Track exceptions, retest remediated assets, and close the item only after evidence is documented
- Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
Evidence notes
Evidence is based on official CVE and NVD records, and source references from GitHub. Limited detail is available on affected scope and potential impact. The CVE record was published on 2026-08-20T22:17:22.200Z and has not been modified since then. BigBlueButton users and administrators should verify their installations and apply patches if necessary. The NVD entry is currently MEDIUM. The issue is fixed in version 3.0.29.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-20T22:17:22.200Z and has not been modified since then.