CVE-2026-46682

{
  "id": "CVE-2026-46682",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-20T22:17:19.347",
  "lastModified": "2026-10-26T10:10:00.140",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, BigBlueButton allowed authenticated moderators to inject SQL through the meetingId and userId values used by refreshBreakoutRoomsVisibleForUsers in akka-bbb-apps/src/main/scala/org/bigbluebutton/core/db/BreakoutRoomUserDAO.scala. The method interpolated those values into breakout room visibility queries, allowing arbitrary SQL execution against the application database. This issue is fixed in version 3.0.23."
    },
    {
      "lang": "es",
      "value": "BigBlueButton es un aula virtual de código abierto. Antes de la versión 3.0.23, BigBlueButton permitía a los moderadores autenticados inyectar SQL a través de los valores meetingId y userId utilizados por refreshBreakoutRoomsVisibleForUsers en akka-bbb-apps/src/main/scala/org/bigbluebutton/core/db/BreakoutRoomUserDAO.scala. El método interpolaba esos valores en consultas de visibilidad de salas de grupo, permitiendo la ejecución arbitraria de SQL contra la base de datos de la aplicación. Este problema se ha corregido en la versión 3.0.23."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "bigbluebutton",
          "product": "bigbluebutton",
          "versions": [
            {
              "version": "< 3.0.23",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L",
          "baseScore": 8.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 4.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-21T20:58:33.541288Z",
          "id": "CVE-2026-46682",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/bigbluebutton/bigbluebutton/commit/3365e340e0c102de0f8ea007c05053b562b6fa2b",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/bigbluebutton/bigbluebutton/releases/tag/v3.0.23",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-gfv2-46v4-jvw5",
      "source": "[email protected]"
    }
  ]
}