Is BigBlueButton 2.6.3 affected?

Vulnerabilities affecting 2.6.3

• 10.0
  GHSA-4g74-4wqf-fr8c Path Traversal through etherpad-lite fixed in 3.0.35
• 9.9
  GHSA-h2rp-mcch-vgh9 Stored XSS in annotation through /graphql via GraphQL Mutation "url" fixed in 3.0.29
• 9.8
  GHSA-q8vx-4cgc-7w4w Improper Authentication through /api/join via POST parameter "auth" fixed in 3.0.29
• 9.6
  GHSA-v28f-mvg5-mv7m Arbitrary local file read via crafted SVG presentation upload fixed in 3.0.16
• 9.0
  GHSA-f6gw-hpfv-5gxg Command Injection through "destination_number" fixed in 3.0.38
• 8.9
  CVE-2026-27737 Stored XSS in bbb-playback replay fixed in 3.0.19
• 8.5
  CVE-2026-46682 Blind SQL Injection AUTH (Moderator) fixed in 3.0.23
• 8.1
  CVE-2026-46353 BigBlueButton API checksum bypass via presentationUploadExternalUrl fixed in 3.0.21
• 8.1
  CVE-2026-46351 Insecure Randomness allows to guess user's conference session token and impersonate them fixed in 3.0.21
• 7.6
  GHSA-8p8h-cw52-x467 GetJoinUrl Parameter Injection and Checksum Pollution fixed in 3.0.37
• 7.5
  CVE-2025-61601 DoS via PollSubmitVote GraphQL mutation leads to BigBlueButton server crash
• 7.5
  CVE-2025-61602 Reacting to messages can make the chat unusable.
• 7.3
  GHSA-h6m5-4xgx-pvpp Stored XSS Through an Unvalidated Audio-Caption Locale in the Legacy Recording Player fixed in 3.0.38
• 7.2
  CVE-2026-27466 Exposed ClamAV port allowing denial of service
• 7.1
  GHSA-g92v-3w29-55rh Cross-meeting audio access via unvalidated voice bridge fixed in 3.0.37
• 7.1
  CVE-2026-46355 Unauthenticated Session Hijack via Exposed /bigbluebutton/api/handleJoinExistingUser fixed in 3.0.23
• 7.1
  CVE-2025-55200 Stored XSS via name of user at Shared Notes
• 7.0
  GHSA-49qg-pcv3-r2g6 Unauthenticated access to a meeting's audio conference fixed in 3.0.38
• 6.8
  CVE-2026-46404 Presentation URL Security Hardening fixed in 3.0.23
• 6.5
  CVE-2026-41127 Missing authorization allows viewer to inject/overwrite captions
• 6.3
  CVE-2023-43797 Stored XSS at Guest Lobby fixed in 2.6.11
• 6.1
  CVE-2026-27736 Open Redirect vulnerability in ApiController
• 5.6
  CVE-2023-43798 Blind SSRF When Uploading Presentation (mitigation bypass) fixed in 2.6.12
• 5.4
  GHSA-5p2g-ff34-ghm3 Breakout room access is not revoked after a participant is removed fixed in 3.0.38
• 5.4
  GHSA-j43j-jmqf-2fg6 Missing server-side enforcement of the maximum number of custom poll options fixed in 3.0.23
• 5.4
  CVE-2026-55491 Stored XSS in Screenshare Recording Playback via Unescaped Meeting Name fixed in 3.0.29
• 5.0
  GHSA-rr62-cx93-4fwh Unescaped poll text in presentation export enables SVG injection and server-side request forgery fixed in 3.0.38
• 4.9
  CVE-2026-55489 IDOR on BBB through /api/graphql via POST parameter "presentationId" leads to Authentication Bypass fixed in 3.0.29
• 4.8
  CVE-2023-33176 Blind SSRF When Uploading Presentation fixed in 2.6.9
• 4.6
  CVE-2024-38518 API Additional Parameters Considered fixed in 2.7.8
• 4.3
  GHSA-52cv-pvw8-89c6 Hidden user list can be bypassed through voice and reaction data fixed in 3.0.38
• 4.3
  GHSA-j5gq-h48h-23r4 Live meeting streams remain accessible to a removed participant fixed in 3.0.38
• 4.3
  GHSA-gjvc-jq4g-58xp BlockNote shared notes accessible to non-members of a meeting fixed in 3.0.38
• 4.3
  GHSA-c4v9-6mvh-px5p Improper enforcement of plugin role restrictions on custom chat messages fixed in 4.0.0-rc.2
• 4.3
  GHSA-mvx6-hg8v-3x4j Cross Meeting Page IDOR fixed in 3.0.37
• 4.3
  GHSA-9v52-vhvw-4w5c Cross-Meeting Presentation Injection Due to an Unbound Upload Token fixed in 3.0.37
• 4.3
  CVE-2026-41126 Open Redirect on bigbluebutton through bigbluebutton/api/join via get-parameter "logoutURL"
• 3.7
  CVE-2024-39302 Some bbb-record-core files installed with wrong file permission fixed in 2.7.8
• 3.1
  GHSA-x795-r9c3-rh9q Whiteboard annotation authorship could be forged by a participant with whiteboard access fixed in 3.0.38
• 2.0
  CVE-2026-27467 Audio from participants to the server initially unmuted

Newer releases