CVE-2026-55489

Received Received - Intake

Cross-Site Presentation Deletion in BigBlueButton

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description

BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton presenters could submit a presentationId through /api/graphql that identified a presentation belonging to another meeting. akka-bbb-apps/src/main/scala/org/bigbluebutton/core/apps/presentationpod/RemovePresentationPubMsgHdlr.scala did not verify the presentation's meeting identifier before deletion, allowing a presenter who knew the identifier to delete another meeting's presentation and disrupt its availability. This issue is fixed in version 3.0.29.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-20

Last Modified

2026-08-20

Generated

2026-08-21

AI Q&A

2026-08-21

EPSS Evaluated

N/A

NVD

CVE-2026-55489

Affected Vendors & Products

Vendor	Product	Version / Range
bigbluebutton	bigbluebutton	3.0.29

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability in BigBlueButton allows a presenter to delete a presentation from another meeting by exploiting a missing check on the presentation's meeting identifier. The flaw exists in the RemovePresentationPubMsgHdlr component which fails to verify ownership before deletion.

Detection Guidance

This vulnerability involves unauthorized deletion of presentations in BigBlueButton meetings. To detect it, monitor logs for unusual presentation deletion events, especially those targeting meetings not owned by the presenter. Check the /api/graphql endpoint for suspicious presentationId submissions. Look for discrepancies between presentation ownership and deletion requests in application logs.

Impact Analysis

If you are a presenter or user of BigBlueButton, this vulnerability could allow another presenter to disrupt your meetings by deleting your presentations. This could cause delays, loss of important content, or meeting interruptions.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR or HIPAA by disrupting the availability of presentations in a virtual classroom setting. Unauthorized deletion of presentations may lead to data integrity issues or unauthorized access to sensitive information, depending on the content of the presentations. However, the specific impact depends on how the vulnerability is exploited in a given environment.

Mitigation Strategies

Upgrade BigBlueButton to version 3.0.29 or later immediately. If upgrading is not possible, restrict access to the /api/graphql endpoint and implement strict validation of presentationId ownership before allowing deletion operations. Review and audit recent presentation deletions for signs of exploitation.

Hi! I’m here to help you understand CVE-2026-55489. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70