PT-2026-21365 · Unknown · Bigbluebutton

Jörg Schwenk + 3 · Publicado 2026-02-21 · Atualizado 2026-02-21 · CVE-2026-27467

Positive Technologies (AI Summary)

CVSS v3.1

2.4

Baixa

Vetor base

AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions BigBlueButton versions 3.0.19 and below

Description BigBlueButton is a virtual classroom platform. When a user joins a session with the microphone initially muted, the client may send audio data to the server despite the mute state. While the server discards this audio, preventing it from being audible to other participants, a malicious server operator could potentially access this data. This behavior occurs only between joining the meeting and the first time the user unmutes.

Recommendations Update to version 3.0.20 or later.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2026-27467

GHSA-6GJ9-5RHM-68J8

Produtos afetados

Bigbluebutton

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27467.json · Exploit
• https://github.com/bigbluebutton/bigbluebutton/commit/3aa47832bc2b17178799bd932453c226e8f95703 · Correção
• https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-6gj9-5rhm-68j8 · Aviso do Fabricante
• https://t.me/CVEtracker/45364 · Publicação no Telegram
• https://t.me/cveNotify/152708 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/2025193416515076180 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-27467 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-27467 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2025154174913011996 · Publicação no Twitter