What is CVE-2026-55489?

CVE-2026-55489 is a medium-severity vulnerability in Bigbluebutton, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 4.9/10. Published 2026-08-20.

How severe is CVE-2026-55489?

Medium severity. CVSS v3 base score is 4.9 out of 10.

Auth bypass in Bigbluebutton

CVE-2026-55489

BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton presenters could submit a presentationId through /api/graphql that identified a presentation belonging to another meeting. akka-bbb-apps/src/main/scala/org/bigbluebutton/core/apps/presentationpod/RemovePresentationPubMsgHdlr.scala did not verify the presentation's meeting identifier before deletion, allowing a presenter who knew the identifier to delete another meeting's presentation and disrupt its availability. This issue is fixed in version 3.0.29.

Vulnerability class: IDOR (Insecure Direct Object Reference)

CVSS v3 metric

CVSS v3 base score 4.9 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:L.

Affected products

Bigbluebutton — versions < 3.0.29

Weakness classification (CWE)

CWE-639 — Authorization Bypass Through User-Controlled Key

References

security-advisories@github.com (x_refsource_CONFIRM)
security-advisories@github.com (x_refsource_MISC)
security-advisories@github.com (x_refsource_MISC)

Frequently asked questions

What is CVE-2026-55489?: CVE-2026-55489 is a medium-severity vulnerability in Bigbluebutton, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 4.9/10. Published 2026-08-20.
How severe is CVE-2026-55489?: Medium severity. CVSS v3 base score is 4.9 out of 10.