Description

BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, BigBlueButton allowed authenticated moderators to inject SQL through the meetingId and userId values used by refreshBreakoutRoomsVisibleForUsers in akka-bbb-apps/src/main/scala/org/bigbluebutton/core/db/BreakoutRoomUserDAO.scala. The method interpolated those values into breakout room visibility queries, allowing arbitrary SQL execution against the application database. This issue is fixed in version 3.0.23.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-08-20T22:17:19.347Z",
  "pubdate": "2026-08-20T22:17:19.347Z",
  "executiveSummary": "An SQL injection vulnerability exists in BigBlueButton prior to version 3.0.23, impacting the virtual classroom application database. The flaw arises due to improper handling of database queries involving specific breakout room parameters.\nAn authenticated attacker possessing moderator privileges can leverage this vulnerability to execute arbitrary SQL commands against the underlying application database.\nThis introduces severe risk implications, including potential data exfiltration, database manipulation, and compromise of application integrity. Successful exploitation requires authentication as a moderator, specifically manipulating input values processed by the application's database access objects.\nOrganizations utilizing affected versions must apply the available vendor patch to remediate the vulnerability and secure database interaction logic against malicious input interpolation.",
  "technicalDetails": "The vulnerability is rooted in the database access logic implemented within the Scala-based backend component of BigBlueButton. Specifically, the vulnerable component is located in the file akka-bbb-apps/src/main/scala/org/bigbluebutton/core/db/BreakoutRoomUserDAO.scala, within the refreshBreakoutRoomsVisibleForUsers method.\nThe root cause of the vulnerability is string interpolation of untrusted input directly into database queries without proper parameterization or sanitization. The parameters susceptible to this improper neutralization are the meetingId and userId values.\nAuthentication and privilege requirements dictate that an attacker must be authenticated and possess moderator privileges within the application context to trigger the vulnerable functionality and supply malicious input parameters.\nThe attack flow proceeds as follows: First, the authenticated moderator initiates or interacts with breakout room management functions that invoke the refreshBreakoutRoomsVisibleForUsers method. Second, the attacker supplies crafted payloads via the meetingId or userId parameters. Third, the application interpolates these unsanitized values directly into the SQL query string executed against the application database.\nPayload behavior involves executing arbitrary SQL statements within the database session context, potentially allowing the retrieval, modification, or deletion of sensitive database records depending on database user permissions and query structure.\nThe post-exploitation impact includes unauthorized data access, potential escalation of privileges within the database environment, and compromise of the confidentiality, integrity, and availability of stored data.\nAffected versions include all BigBlueButton deployments prior to version 3.0.23, where this issue has been officially resolved by the vendor."
}