CVE-2022-29233 Improper access control for breakout rooms in BigBlue Button

BigBlueButton is an open source web conferencing system. In BigBlueButton starting with 2.2 but before 2.3.18 and 2.4-rc-1, an attacker can circumvent access controls to gain access to all breakout rooms of the meeting they are in. The permission checks rely on knowledge of internal ids rather th...

CVE-2022-29233

Summary: CVE-2022-29233 affects BigBlueButton and allows an attacker in a meeting to bypass access controls to reach all breakout rooms. The root cause is permission checks that rely on internal IDs rather than validating the user’s role. Affected versions: 2.2 up to before 2.3.18 and 2.4-rc-1. F...