CVE-2026-27467

LOW EPSS 7.1%
Published Feb 21, 20264mo ago · Modified Jun 17, 20262w ago
2.4 CVSS 3.1
Low
Find Similar
Published Feb 21, 2026 4mo ago
Last Modified Jun 17, 2026 2w ago

Description

BigBlueButton is an open-source virtual classroom. In versions 3.0.19 and below, when first joining a session with the microphone muted, the client sends audio to the server regardless of mute state. Media is discarded at the server side, so it isn't audible to any participants, but this may allow for malicious server operators to access audio data. The behavior is only incorrect between joining the meeting and the first time the user unmutes. This issue has been fixed in version 3.0.20.

CVSS Details

Base Score
2.4
Exploitability
0.9
Impact
1.4
Vector string
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required High
User Interaction Required
Scope Unchanged
Confidentiality Low
Integrity None
Availability None

Threat Intelligence

EPSS Exploit Probability
7.1% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor Information Exposure

Affected Products 1

VendorProductVersionRange
bigbluebuttonbigbluebutton* <3.0.20

References 2

  • github.com https://github.com/bigbluebutton/bigbluebutton/commit/3aa47832bc2b17178799bd932453c226e8f95703
    Patch
  • github.com https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-6gj9-5rhm-68j8
    PatchVendor Advisory

Remediation

  • github.com https://github.com/bigbluebutton/bigbluebutton/commit/3aa47832bc2b17178799bd932453c226e8f95703
    Patch
  • github.com https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-6gj9-5rhm-68j8
    PatchVendor Advisory