CVE-2026-55489

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-55489
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55489.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-55489
Aliases
  • GHSA-jxpq-r3h3-p75g
Published
2026-08-20T21:36:35.127Z
Modified
2026-08-22T09:15:52.901972Z
Severity
  • 4.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:L CVSS Calculator
Summary
BigBlueButton: IDOR on BBB through /api/graphql via POST parameter "presentationId" leads to Authentication Bypass
Details

BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton presenters could submit a presentationId through /api/graphql that identified a presentation belonging to another meeting. akka-bbb-apps/src/main/scala/org/bigbluebutton/core/apps/presentationpod/RemovePresentationPubMsgHdlr.scala did not verify the presentation's meeting identifier before deletion, allowing a presenter who knew the identifier to delete another meeting's presentation and disrupt its availability. This issue is fixed in version 3.0.29.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-639"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55489.json"
}
References

Affected packages

Git / github.com/bigbluebutton/bigbluebutton

Affected ranges

Type
GIT
Repo
https://github.com/bigbluebutton/bigbluebutton
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
c9e93f9af07b9661e286d101b83cbccb891c551f
Fixed
e9d0534de2f014d1903d8c54885ca6acd5758a69
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.0.29"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

2.*
2.2-beta-10
2.2-beta-11
2.2-beta-12
2.2-beta-14
2.2-beta-15
2.2-beta-16
2.2-beta-17
2.2-beta-18
2.2-beta-19
2.2-beta-2
2.2-beta-20
2.2-beta-21
2.2-beta-22
2.2-beta-23
2.2-beta-3
2.2-beta-4
2.2-beta-5
2.2-beta-6
2.2-beta-7
2.2-beta-8
2.2-beta-9
2.2-rc-1
2.2-rc-2
2.2-rc-3
3.*
3.0.0-rc.1
Other
dcs-2-a
v0.*
v0.8
v0.8b4
v0.8b4.0
v0.8rc2
v0.9.0-beta
v2.*
v2.3-alpha-1
v2.3-alpha-2
v2.3-alpha-3
v2.3-alpha-4
v2.3-alpha-5
v2.3-alpha-6
v2.3-alpha-7
v2.3-alpha-8
v2.3-beta-1
v2.3-beta-2
v2.3-beta-3
v2.3-beta-4
v2.3-beta-5
v2.3-rc-1
v2.3-rc-2
v2.3.0
v2.3.1
v2.4-alpha-1
v2.4-beta-1
v2.4-beta-2
v2.4-beta-3
v2.4-beta-4
v3.*
v3.0.0
v3.0.0-alpha.1
v3.0.0-alpha.2
v3.0.0-alpha.3
v3.0.0-alpha.4
v3.0.0-alpha.6
v3.0.0-alpha.7
v3.0.0-beta.1
v3.0.0-beta.2
v3.0.0-beta.3
v3.0.0-beta.4
v3.0.0-beta.5
v3.0.0-beta.6
v3.0.0-beta.7
v3.0.0-rc.1
v3.0.0-rc.2
v3.0.0-rc.3
v3.0.0-rc.4
v3.0.1
v3.0.10
v3.0.11
v3.0.12
v3.0.13
v3.0.14
v3.0.15
v3.0.16
v3.0.17
v3.0.18
v3.0.19
v3.0.2
v3.0.20
v3.0.21
v3.0.22
v3.0.23
v3.0.24
v3.0.25
v3.0.26
v3.0.27
v3.0.28
v3.0.3
v3.0.4
v3.0.5
v3.0.7
v3.0.8
v3.0.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55489.json"
vanir_signatures 
[
    {
        "target": {
            "file": "bbb-common-web/src/main/java/org/bigbluebutton/api/model/validator/ContentTypeValidator.java"
        },
        "deprecated": false,
        "source": "https://github.com/bigbluebutton/bigbluebutton/commit/e9d0534de2f014d1903d8c54885ca6acd5758a69",
        "id": "CVE-2026-55489-50314cb5",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "171893269864785211469490273169048262713",
                "47513062551889159024279848957257221677",
                "47534136755514569330082593582056901645",
                "305711170735977579354243743203764300734"
            ]
        },
        "signature_type": "Line"
    },
    {
        "target": {
            "file": "bbb-common-web/src/main/java/org/bigbluebutton/api/model/request/GuestWait.java"
        },
        "deprecated": false,
        "source": "https://github.com/bigbluebutton/bigbluebutton/commit/e9d0534de2f014d1903d8c54885ca6acd5758a69",
        "id": "CVE-2026-55489-6b266d02",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "242161247612091681100423810891252332199",
                "336526248208291997279047623853597944547",
                "176670872078812572766531800661639465980",
                "59848718246103412995454615425602721599",
                "300146863375822521627161709113960709769",
                "86182153846938859175093782766426681134",
                "587832367915583864481176421532364858"
            ]
        },
        "signature_type": "Line"
    },
    {
        "target": {
            "file": "bbb-common-web/src/main/java/org/bigbluebutton/api/model/request/JoinMeeting.java"
        },
        "deprecated": false,
        "source": "https://github.com/bigbluebutton/bigbluebutton/commit/e9d0534de2f014d1903d8c54885ca6acd5758a69",
        "id": "CVE-2026-55489-a7aeaaed",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "88434799640558778257288228062920158108",
                "7251528062029604322044188788066397728",
                "44645748650457402782589726500135861904",
                "192557370480273023032816370500131288245",
                "161592334185906639935064986523263119018",
                "62985558293612551570530917162184907836",
                "121902534756978404699464605633463101852"
            ]
        },
        "signature_type": "Line"
    },
    {
        "target": {
            "file": "bbb-common-web/src/main/java/org/bigbluebutton/api/model/request/SendChatMessage.java"
        },
        "deprecated": false,
        "source": "https://github.com/bigbluebutton/bigbluebutton/commit/e9d0534de2f014d1903d8c54885ca6acd5758a69",
        "id": "CVE-2026-55489-de39e59c",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "271139484060790763689471598057212025245",
                "318692501593149580994691245162046212209",
                "152607542981530139437516851601796342454",
                "91766718737915328782003972435491559125",
                "276801988874348428298731527743172764529",
                "1523102452266288933963449728119574323",
                "128192166450262049977948850596230053321",
                "163633938008796078489867408267787334498",
                "31749120539060753812456029450628446990",
                "121902534756978404699464605633463101852"
            ]
        },
        "signature_type": "Line"
    },
    {
        "target": {
            "function": "isValid",
            "file": "bbb-common-web/src/main/java/org/bigbluebutton/api/model/validator/ContentTypeValidator.java"
        },
        "deprecated": false,
        "source": "https://github.com/bigbluebutton/bigbluebutton/commit/e9d0534de2f014d1903d8c54885ca6acd5758a69",
        "id": "CVE-2026-55489-e6a7f401",
        "signature_version": "v1",
        "digest": {
            "length": 648.0,
            "function_hash": "234938860166603979418016340001434754519"
        },
        "signature_type": "Function"
    }
]
vanir_signatures_modified 
"2026-08-22T09:15:52Z"