Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2026-41127

BigBlueButton's missing authorization allows viewer to inject/overwrite captions

Description

BigBlueButton is an open-source virtual classroom. Versions prior to 3.0.24 have a missing authorization that allows viewers to inject/overwrite captions Version 3.0.24 tightened the permissions on who is able to submit captions. No known workarounds are available.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

bigbluebutton bigbluebutton

  • < 3.0.24affected

References