# CVE-2026-46682: BigBlueButton SQL injection in breakout room visibility query

Source: https://junglewise.ai/threats/cve-2026-46682-bigbluebutton-sql-injection-in-breakout-room-visibility-query  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-46682 · Severity: high · CVSS 8.5 · Published 2026-08-20

BigBlueButton is an open-source virtual classroom platform used for online meetings and education. Authenticated moderators could exploit a SQL injection vulnerability in breakout room functionality to execute arbitrary database queries, potentially exposing or modifying sensitive meeting data stored in the application database.

Technologies: [BigBlueButton](https://junglewise.ai/threats/technologies/bigbluebutton). Vendors: [BigBlueButton](https://junglewise.ai/threats/vendors/bigbluebutton).

## Quick answers

**Is CVE-2026-46682 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-46682 being exploited in the wild.

**How severe is CVE-2026-46682?** High severity, with a CVSS score of 8.5, published 20 August 2026.

**Which products and versions are affected?** BigBlueButton before 3.0.23.

**Is there a fix for CVE-2026-46682?** A patch was published on 2026-03-16: Fixed in version 3.0.23 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-46682 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-46682?** Check whether you run BigBlueButton at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a SQL injection flaw in the refreshBreakoutRoomsVisibleForUsers method located in BreakoutRoomUserDAO.scala. The method fails to use parameterized queries and instead directly interpolates the meetingId and userId parameters into SQL queries without sanitization. An authenticated moderator can craft malicious SQL through these parameters to execute arbitrary commands against the application database. The vulnerability requires authentication as a moderator and network access to BigBlueButton. This issue is fixed in version 3.0.23 through the use of bound parameters in SQL queries.

## Affected products

- BigBlueButton BigBlueButton before 3.0.23

## Timeline

- 2026-08-20: disclosed
- 2026-03-16: patched: Fixed in version 3.0.23

## References

- [https://github.com/bigbluebutton/bigbluebutton/commit/3365e340e0c102de0f8ea007c05053b562b6fa2b](https://github.com/bigbluebutton/bigbluebutton/commit/3365e340e0c102de0f8ea007c05053b562b6fa2b)
- [https://github.com/bigbluebutton/bigbluebutton/releases/tag/v3.0.23](https://github.com/bigbluebutton/bigbluebutton/releases/tag/v3.0.23)

## Related threats

- [BigBlueButton stored XSS in recording playback](https://junglewise.ai/threats/cve-2026-55491-bigbluebutton-stored-xss-in-recording-playback)
- [BigBlueButton presentation deletion authorization bypass](https://junglewise.ai/threats/cve-2026-55489-bigbluebutton-presentation-deletion-authorization-bypass)
- [BigBlueButton authentication bypass in API controller](https://junglewise.ai/threats/cve-2026-46355-bigbluebutton-authentication-bypass-in-api-controller)
- [BigBlueButton SSRF in presentation URL validation](https://junglewise.ai/threats/cve-2026-46404-bigbluebutton-ssrf-in-presentation-url-validation)
- [BigBlueButton bbb-web checksum bypass in API request handling](https://junglewise.ai/threats/cve-2026-46353-bigbluebutton-bbb-web-checksum-bypass-in-api-request-handling)