Executive brief
BigBlueButton is an open-source virtual classroom platform used for online meetings and education. Authenticated moderators could exploit a SQL injection vulnerability in breakout room functionality to execute arbitrary database queries, potentially exposing or modifying sensitive meeting data stored in the application database.
Technical details
The vulnerability is a SQL injection flaw in the refreshBreakoutRoomsVisibleForUsers method located in BreakoutRoomUserDAO.scala. The method fails to use parameterized queries and instead directly interpolates the meetingId and userId parameters into SQL queries without sanitization. An authenticated moderator can craft malicious SQL through these parameters to execute arbitrary commands against the application database. The vulnerability requires authentication as a moderator and network access to BigBlueButton. This issue is fixed in version 3.0.23 through the use of bound parameters in SQL queries.
Affected products
- BigBlueButton BigBlueButton before 3.0.23
Timeline
- 2026-08-20: disclosed
- 2026-03-16: patched: Fixed in version 3.0.23