Main Vulnerability Database Vulnerabilities #VU150170

Improper access control in BigBlueButton - #VU150170

Published: September 16, 2026

Vulnerability identifier: #VU150170

CSH Severity: Medium

CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: N/A

CWE-ID: CWE-284

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to insecure direct object reference (IDOR) issue.A remote user in one meeting can perform actions in another meeting.

BigBlueButton

Install updates from vendor's website.

BigBlueButton - addressed in versions 3.0.37, 4.0.0 rc.2