BigBlueButton 3.0.21 → 3.0.28
7 releases · 1 breaking change · 9 security fixes · 7 advisories fixed
9security1breaking1deprecated20feature98fix
Vulnerabilities fixed by this upgrade
- 5.4 GHSA-j43j-jmqf-2fg6 Missing server-side enforcement of the maximum number of custom poll options
- 7.1 CVE-2026-46355 Unauthenticated Session Hijack via Exposed /bigbluebutton/api/handleJoinExistingUser
- 8.5 CVE-2026-46682 Blind SQL Injection AUTH (Moderator)
- 6.8 CVE-2026-46404 Presentation URL Security Hardening
- 6.5 CVE-2026-41127 Missing authorization allows viewer to inject/overwrite captions
- 4.3 CVE-2026-41126 Open Redirect on bigbluebutton through bigbluebutton/api/join via get-parameter "logoutURL"
- 7.2 CVE-2026-27466 Exposed ClamAV port allowing denial of service
Breaking changes
- breaking Ref(html5): Remove non-used settings in 3.0.25
Security changes
- security Missing authorization allows viewer to inject/overwrite captions https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-q387-2q28-mg33 in 3.0.24
- security Open Redirect on bigbluebutton through bigbluebutton/api/join via get-parameter "logoutURL" https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-cvwj-4pcp-f3g8 in 3.0.24
- security fix(bbb-web): Make ApiController Helper Methods Private contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-38fw-2gq7-ccgr will be made public not earlier than March 24, 2026 in 3.0.23
- security fix(core): enforce maxCustom poll settings on akka contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-j43j-jmqf-2fg6 will be made public not earlier than March 24, 2026 in 3.0.23
- security fix(akka-apps): Use Bind Parameters in SQL Query contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-gfv2-46v4-jvw5 will be made public not earlier than March 24, 2026 in 3.0.23
- security fix(bbb-web): Fix Presentation Download URL Validation by @paultrudel @gustavotrott in https://github.com/bigbluebutton/bigbluebutton/commit/7ccc60c965d744d9fb637715052352a1e59a2c27 contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-xqm3-6q7q-4v5h will… in 3.0.23
- security fix(core): enforce chat min-max character settings on akka contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-qfv6-rv7x-6rq6 will be made public not earlier than March 24, 2026 in 3.0.23
- security Fix(akka): restrict markdown chat content contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-3m6h-47j2-83r4 will be made public not earlier than Feb 24, 2026 in 3.0.22
- security [3.0]chore: clamav tighten command contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-wmhx-qw2p-w6gc will be made public not earlier than Feb 24, 2026 in 3.0.22
Deprecations
- deprecated [3.0 external video share] remove deprecated parameters in 3.0.26
Every release in between
fixfix: bn- table crash with static toolbar
fixfix: activating the listen-in function results in an error (drop out of user from the breakout room)
fixfix (html5/shared-notes-server): Read-only fixes and new version for BlockNote
fixfix (html5/bbb-web): Preloading of slides not working for proxy setups
fixfix: Talking indicator some letters are cut off
fixfix (html5): Fix genaral blocknotes issues related with losing focus
fixfix(accessibility): settings dropdown keyboard navigation
fixfix (shared-notes-server): Simplify permission handling
fixfix (shared-notes-server): Badge not being showed when shared notes is changed (in BlockNote)
fixfix (shared-notes-server/cluster): Use $bbb_cors_origin for shared-notes-server Allow-Origin (CORS)
otherref: change text align select button to remove previous selector
featurefeat(livekit): add forceRelay/forceRelayOnFirefox settings, +
featurefeat(accessibility): add Esc shortcut to move focus in/out of the BlockNote shared notes editor
otherperf (html5): Improve video stream queries for server performance
featurefeat: Added patched flag to users basic info subscription
fixfix (tests): make Play/Pause test env-independent by comparing screenshots dynamically
fixfix(tests): stabilize "Upload multiple presentations" against toast race
other[3.0 locales] Updates for project BigBlueButton v3.0 HTML5 client
otherrefactor (akka-apps / LAD): Improve session grouping after disconnect
otherrefactor(core): create public media groups groups lazily, +
otherperf (gql-middleware): improve json patcher, produce minimal patches via LCS-based move generation
featurefeat(core): recording parameter passthrough to breakouts
featurefeat(core): allow moderators to manage lock settings inside breakout rooms and optionally inherit parent meeting lock settings on creation
fixfix(core): breakout: propagate parent client settings override
fixfix(bbb-web): Enforce Presentation File Size Limits On All Paths
fixfix: Recordings break on nfs
otherRevert "fix: Recordings break on nfs"
fixfix(recording): address ffmpeg high memory usage from video PTS gaps
featurerecording: add internal docs for video edl/layout
otherbuild(shared-notes-server): Add postgresql-14 as a dependency in opts…
otherbuild(bbb-playback): Bump to bbb-playback to v5.4.7
otherbuild(deps): [email protected] (up from 2.17.1)
otherdocs: add CLAUDE.md with operational notes for the Docusaurus site
otherdocs: document bigbluebutton.properties additions in BBB 3.0.27
otherUpdate action text and documentation link
otherdocs: Add some missing properties of manifest.json in the docs
otherchore: update @bigbluebutton/tldraw from alpha.33 to alpha.34
otherbuild(deps): bump the npm_and_yarn group across 2 directories with 2 updates
otherchore: update @bigbluebutton/tldraw from alpha.34 to alpha.35
otherbuild(deps): bump the npm_and_yarn group across 6 directories with 1 update
+8 more items in the release notesfixfix(html5): restore Ctrl+Z / Ctrl+Shift+Z in BlockNote
fixfix: Poll/quiz publishing does not show notification to viewers
fixfix: Guests note missing / disappearing
fixfix: lockSettingsHideUserList leaks usernames in the chat if a viewer was (temp) set to presenter
fixfix(client): Fix Android being too greedy with Safari user agent (fixes #24295)
fixfix: Fix performance issue with block-note dark mode
fixfix(breakouts): user id handling
fixFix(html5): Presenter whiteboard camera position moving on window resizing
fixfix: fix hardcoded colors scheme for exported notes.html
fixfix: bn- table crash with static toolbar
featurefeat: Enable users to pan outside the current presenters view during infinite whiteboard
otherrefactor(livekit): memoize useMediaSenders result (selective sub)
otherref: decrease size of block-note toolbar
fixfix (ci/tests): Stabilize cross-page slide comparison
other[3.0 locales] Updates for project BigBlueButton v3.0 HTML5 client
fixfix(bbb-web): Add Callback URL Validation
otherrefactor (gql-middleware): Minor improvements
otherrefactor(bbb-web): Update Plugin URL Handling
fixfix (gql-server): Set typing=false once user edited a message
featurefeat: cache plugin manifest files with bbb-web
fixfix(presentation): Require SessionToken and PageToken on Presentation Page Requests
other[3.0 recording] fix: external video recording not shown after screenshare
fixfix(recording): add presentation minimized events + screenshare as content fixes
fixfix(recording): Fix events archiving on servers with blocknote
otherbuild: Update bbb-pads branch to v1.5.11
otherbuild: bump bbb-playback to 5.4.5
otherbuild: Update bbb-playback branch to v5.4.6
otherdocs(administration): fix typos in lti.md
otherdocs: rebuild "Other meeting configs available" table
otherchore: Migrate from deprecated GitHub Stale App to actions/stale, exempt milestone issues
otherchore: Replace defunct behaviorbot/welcome app with GitHub Actions workflow
otherchore: Expand welcome workflow first-time contributor detection
otheriteration: BigBlueButton 3.0.27
otherbuild(deps): bump the npm_and_yarn group across 2 directories with 1 update
otherbuild(deps): bump the npm_and_yarn group across 3 directories with 1 update
otherbuild(deps): bump ip-address from 10.1.0 to 10.2.0 in /bbb-learning-dashboard in the npm_and_yarn group across 1 directory
otherbuild(deps): bump the npm_and_yarn group across 4 directories with 1 update
otherbuild(deps): bump mermaid from 11.12.3 to 11.15.0 in /docs in the npm_and_yarn group across 1 directory
fixfix(html5): keep loading screen during graphql retries and show error screen on connection timeout
fixfix(html5): prevent pinch-to-zoom for viewers and WB users on touch devices
fixfix: suppress join/leave notifications for locked viewers when hideUserList is active
fixfix (html5): Export of Block Notes broken for cluster setup
fixfix: blocknote placeholder wrap when container size too small
other[3.0 port] fix: exclude audio-only tiles from SFU subscription and plugin buttons
featurefeat (html5): Implement static toolbar for BlockNote
deprecated[3.0 external video share] remove deprecated parameters
other[3.0 locales] Updates for project BigBlueButton v3.0 HTML5 client
otherchore(livekit): enable reconnectOnFatalFailure by default
fixfix(livekit): dial-in unable to be heard by web users
other[3.0 port] fix(bbb-web): respond to /create before downloading pre-uploaded presentations
fixfix(bbb-web): Upgrade Dependencies
fixrecording: Fix hang when deskshare audio ends before video
fixfix (build): Install XDG_RUNTIME_DIR drop-in in Docker for bbb-shared-notes-server
otherdocs: Document lockSettingsHideViewersAnnotation /create parameter
otherdocs: Fix livekit setup commands
otherdocs: Mention sharedNotesEditor was added as a create param
otherdocs: Refactor/restructure BBB 3.0 api changes to be more readable
otherdocs: Fix - strings were being interpreted as True
otherdocs: Simplify bbb-web dev instructions
otherdocs: Document events.xml LayoutBroadcastedEvent addition
otherdocs: Fix typos and iterate over 3.0 docs
otherdocs: bump bbb version to 3.0.26
other[3.0 doc] Guide to use developing html5 client
otherci: bump GitHub Actions to Node 24 versions
fixfix(whiteboard): prevent presenter/viewer viewed-region desync after fullscreen
fixFix(html5): Make the cursor point respect the pointerDiameter setting
fixfix(html5): Notifications being clipped on mobile
fixfix(html5): fix question detection and indented option matching
fixfix: review breakout room moderator actions
fixfix: Breakouts: viewers sent to waiting lobby
fixFix(html5): WB camera position change on slide change when zoom applied
fixFix(html5): zoom with mouser wheel not being centered
fixfix: client crashes when a invalid layout is set in local storage(port to 3.0)
fixfix(html5, tests): only display allowed shapes in edit mode
fixfix(chat): display message timestamp using locale-aware time format
fixFix(html5): cursor zoom misalignment
fixFix(html5): cursor appearing on wrong position to viewers
fixfix: State events leak between user sessions or tabs
featurefeat: Block note integration
breakingRef(html5): Remove non-used settings
featurefeat: extend audio groups to cameras and screen sharing
otherrefactor(livekit): review camera and screen sharing quality presets and simulcast layers
featurefeat(livekit): option to use LiveKit as the client's audio state source
featurefeat(livekit): add a last N-like system to selective subscription (audio)
fixfix(livekit): only display screenshare volume control if there's audio
fixfix(livekit): use LK APIs for WebRTC stats gathering, fix edge cases
featurefeat(html5): Automate asset compression with Webpack
fixfix(html5): exclude .gz files from language selector list
otherRef(html5): Make webcam show ui on hover or touch hold
otherci: remove 3rd-party packages pull + install
othertests: update connection status tests
othertests: update flaky tests
fixfix(plugin-sdk): screenshare blocks snapshot of current slide for plugin-sdk
fixfix(plugin-sdk): Change loading value of a subscription when data didn't change
fixfix(LAD): Generic data keeps updating in plugin's table
featurefeat(plugin-sdk): Add svg icon for all extensible areas
fixfix(bbb-web): Disable External Entity Parsing in XML Services
featurefeat (bbb-web): Introduce a new /create param clientSettingsOverrideJsonUrl
fixfix(akka-apps): Remove Unnecessary Akka Apps Logging
fixfix(bbb-web): Upgrade Grails and Spring Boot
fixfix(bbb-web): Prevent SVGs From Being Generated With Zero Value Dimensions
fixFix(akka): Add Disable feature support for plugins
fixfix(LAD): Legacy dasboard data files not working with newer version of BBB
fixfix(recording): Address A/V sync issues, glitches on cuts, ffmpeg memory usage (audio)
+36 more items in the release notessecurityMissing authorization allows viewer to inject/overwrite captions https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-q387-2q28-mg33
securityOpen Redirect on bigbluebutton through bigbluebutton/api/join via get-parameter "logoutURL" https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-cvwj-4pcp-f3g8
fixFix(html5): The video preview and audio modals open even with the lock settings settings enabled
fixfix: trim spaces of external video url
otherUpdate external video label to remove unsupported platform
fixfix: WhiteBoard Ctrl+D work only once
fixfix: userdata-bbb_override_default_locale is ineffective in guest lobby
otherBreakouts: ensure moderator only functionality is not shown
featurefeat: Make webcamBackgroundURL available in breakouts
fixFix(html5): Space bar key problem on WB
otherstyle: Improve visual hierarchy and UX of guest lobby screen by @tylercopeland @ramonlsouza
fixFix(html5): Recalculate time sync when a new minimal rtt is available
fixfix: talking indicator behind webcam area - custom and smart layouts
fixfix(html5): session details closing when user talks
fixfix(whiteboard): scope slide zoom state to presentation id by @ramonlsouza @germanocaumo
otherrefactor(client): Reword You have been banned message
otherchore: temporarily disable breakout audio transfer UI when using LiveKit
othertest: add test cases for external video
fixfix (ci): attempt to fix: Error: Input required and not supplied: token for Cleanup Playwright reports workflow
otherci: avoid running GH workflows after PR is merged when it's not necessary at this point
other[3.0 locales] Updates for project BigBlueButton v3.0 HTML5 client https://github.com/bigbluebutton/bigbluebutton/pull/24667 https://github.com/bigbluebutton/bigbluebutton/pull/24733
otherUpdates for project BigBlueButton v3.0 HTML5 client and language eu
fixfix (akka-apps): Prevent race condition when a user joins a breakout room
fixfix (gql-server): Not re-assigning users to their last breakout room
fixfix (akka-apps): not storing user activity for breakout rooms (only main meeting)
otherrefactor(core): Breakouts moderator vs viewer
otherrefactor: drop logging of password/authToken
securityfix(bbb-web): Make ApiController Helper Methods Private contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-38fw-2gq7-ccgr will be made public not earlier than March 24, 2026
securityfix(core): enforce maxCustom poll settings on akka contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-j43j-jmqf-2fg6 will be made public not earlier than March 24, 2026
fixfix: Additional checks in polls
securityfix(akka-apps): Use Bind Parameters in SQL Query contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-gfv2-46v4-jvw5 will be made public not earlier than March 24, 2026
securityfix(bbb-web): Fix Presentation Download URL Validation by @paultrudel @gustavotrott in https://github.com/bigbluebutton/bigbluebutton/commit/7ccc60c965d744d9fb637715052352a1e59a2c27 contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-xqm3-6q7q-4v5h will…
securityfix(core): enforce chat min-max character settings on akka contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-qfv6-rv7x-6rq6 will be made public not earlier than March 24, 2026
otherchore(recording): Bump bbbevents to 2.0.3
fixfix(recording): Detect system sender correctly in breakouts recording
otherRecording: avoid short cuts in audio processing
otherbuild: require running redis for bbb-export-annotations.service
otherbuild: [email protected] (up from v1.9.9), [email protected] (up from v2.3.1), +
otherbuild: Update .gitlab-ci.yml with Go 1.26.0 and NodeJS 22.22.0
featureAdd firewalld support to apply-lib.sh
fixfix(conf): Avoid bbb-conf noise on empty bigbluebutton.properties
featurefeat(conf): Warn about retired bbb-web properties
+6 more items in the release notesfixFix(html5): Annotations get transferred to another presentation
otherrefactor: camera custom pagination settings
fixfix (html5): Always include presenter in cursors list
otherRefactor(html5): Improve deduplication logic for toastify
fixfix(audio): missing CC icon in talking indicator (mediasoup/FS)
fixfix: userdata-bbb_auto_share_webcam=true causes webcams to stay enabled when joining breakout rooms
fixfix: Leave meeting button oversize area
otherrefactor: remove unused component
fixfix: pushLayout default settings
fixfix: audio modal should have precedence over video modal
featureIntroduce showAudioOnlyOnFirstPage and maxAudioOnlyUsers settings
fixFix(html5): Eraser not being persisted in the batch
fixfix: audio-only tiles appear in all layouts
othertest(docs): Update README and remove config for browsers not fully supported
otherrefactor: Add data-test to a few user-list components
fixfix(workflow): Update publish-results workflow with robust PR resolution, cleanup, and in‑progress rerun handling
fixfix(workflow): Publish test-results under workflow ID
othertests: adjust toast element check
othertest(chore): [Snyk] Security upgrade axios from 1.12.2 to 1.13.5 https://github.com/bigbluebutton/bigbluebutton/pull/24632
otherUpdates for project BigBlueButton v3.0 HTML5 client and language et https://github.com/bigbluebutton/bigbluebutton/pull/24600
otherrefactor (gql-middleware): Make message caches meeting-scoped
securityFix(akka): restrict markdown chat content contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-3m6h-47j2-83r4 will be made public not earlier than Feb 24, 2026
fixfix(core): Fix transcription problem with multiple users speaking at the same time
fixfix(export): respect autoSize property for text annotations
otherchore(export-annot): Bump axios to 1.13.5 by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/24640
fix[3.0]docs: Fix broken links
otherdocs: Adjust wording of welcome message location
security[3.0]chore: clamav tighten command contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-wmhx-qw2p-w6gc will be made public not earlier than Feb 24, 2026