Is BigBlueButton 3.0.21 affected?

Vulnerabilities affecting 3.0.21

• 10.0
  GHSA-4g74-4wqf-fr8c Path Traversal through etherpad-lite fixed in 3.0.35
• 9.9
  GHSA-h2rp-mcch-vgh9 Stored XSS in annotation through /graphql via GraphQL Mutation "url" fixed in 3.0.29
• 9.8
  GHSA-q8vx-4cgc-7w4w Improper Authentication through /api/join via POST parameter "auth" fixed in 3.0.29
• 9.0
  GHSA-f6gw-hpfv-5gxg Command Injection through "destination_number" fixed in 3.0.38
• 8.5
  CVE-2026-46682 Blind SQL Injection AUTH (Moderator) fixed in 3.0.23
• 7.6
  GHSA-8p8h-cw52-x467 GetJoinUrl Parameter Injection and Checksum Pollution fixed in 3.0.37
• 7.3
  GHSA-h6m5-4xgx-pvpp Stored XSS Through an Unvalidated Audio-Caption Locale in the Legacy Recording Player fixed in 3.0.38
• 7.2
  CVE-2026-27466 Exposed ClamAV port allowing denial of service
• 7.1
  GHSA-g92v-3w29-55rh Cross-meeting audio access via unvalidated voice bridge fixed in 3.0.37
• 7.1
  CVE-2026-46355 Unauthenticated Session Hijack via Exposed /bigbluebutton/api/handleJoinExistingUser fixed in 3.0.23
• 7.0
  GHSA-49qg-pcv3-r2g6 Unauthenticated access to a meeting's audio conference fixed in 3.0.38
• 6.8
  CVE-2026-46404 Presentation URL Security Hardening fixed in 3.0.23
• 6.5
  CVE-2026-41127 Missing authorization allows viewer to inject/overwrite captions
• 5.4
  GHSA-5p2g-ff34-ghm3 Breakout room access is not revoked after a participant is removed fixed in 3.0.38
• 5.4
  GHSA-j43j-jmqf-2fg6 Missing server-side enforcement of the maximum number of custom poll options fixed in 3.0.23
• 5.4
  CVE-2026-55491 Stored XSS in Screenshare Recording Playback via Unescaped Meeting Name fixed in 3.0.29
• 5.0
  GHSA-rr62-cx93-4fwh Unescaped poll text in presentation export enables SVG injection and server-side request forgery fixed in 3.0.38
• 4.9
  CVE-2026-55489 IDOR on BBB through /api/graphql via POST parameter "presentationId" leads to Authentication Bypass fixed in 3.0.29
• 4.3
  GHSA-52cv-pvw8-89c6 Hidden user list can be bypassed through voice and reaction data fixed in 3.0.38
• 4.3
  GHSA-j5gq-h48h-23r4 Live meeting streams remain accessible to a removed participant fixed in 3.0.38
• 4.3
  GHSA-gjvc-jq4g-58xp BlockNote shared notes accessible to non-members of a meeting fixed in 3.0.38
• 4.3
  GHSA-c4v9-6mvh-px5p Improper enforcement of plugin role restrictions on custom chat messages fixed in 3.0.37
• 4.3
  GHSA-mvx6-hg8v-3x4j Cross Meeting Page IDOR fixed in 3.0.37
• 4.3
  GHSA-9v52-vhvw-4w5c Cross-Meeting Presentation Injection Due to an Unbound Upload Token fixed in 3.0.37
• 4.3
  CVE-2026-41126 Open Redirect on bigbluebutton through bigbluebutton/api/join via get-parameter "logoutURL"
• 3.1
  GHSA-x795-r9c3-rh9q Whiteboard annotation authorship could be forged by a participant with whiteboard access fixed in 3.0.38

Newer releases