{"id":"CVE-2026-46682","aliases":["GHSA-gfv2-46v4-jvw5"],"url":"https://o3.security/vulnerability/CVE-2026-46682","summary":"BigBlueButton: Blind SQL Injection AUTH (Moderator)","details":"BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, BigBlueButton allowed authenticated moderators to inject SQL through the meetingId and userId values used by refreshBreakoutRoomsVisibleForUsers in akka-bbb-apps/src/main/scala/org/bigbluebutton/core/db/BreakoutRoomUserDAO.scala. The method interpolated those values into breakout room visibility queries, allowing arbitrary SQL execution against the application database. This issue is fixed in version 3.0.23.","published":"2026-08-20T21:33:56.431Z","modified":"2026-08-22T03:49:46.367376138Z","cvss":{"score":8.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":{"url":"https://github.com/bigbluebutton/bigbluebutton/commit/3365e340e0c102de0f8ea007c05053b562b6fa2b","label":"bigbluebutton/bigbluebutton@3365e34"},"references":[{"type":"WEB","url":"https://github.com/bigbluebutton/bigbluebutton/releases/tag/v3.0.23"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46682.json"},{"type":"ADVISORY","url":"https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-gfv2-46v4-jvw5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46682"},{"type":"FIX","url":"https://github.com/bigbluebutton/bigbluebutton/commit/3365e340e0c102de0f8ea007c05053b562b6fa2b"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-22T03:49:46.367376138Z"}}