CVE-2026-46682

This SQL injection in BigBlueButton's BreakoutRoomUserDAO is notable less for its technical mechanism than for what its existence reveals about the codebase's security posture. The vulnerability requires authenticated moderator access, which isn't a mitigation — it's a diagnostic. In virtual classroom software, moderators are the primary users (teachers, facilitators), not peripheral administrators. This means the 'authenticated prerequisite' doesn't narrow the blast radius so much as it describes the intended user base having direct database access to their own platform's data. The trust boundary wasn't misconfigured; it was never drawn at all. Moderator accounts in BBB accumulate privilege incrementally through feature requests evaluated against 'does this let the moderator do their job' rather than 'does this expand the attack surface.' The fix in a single DAO file patches the symptom without resetting that underlying assumption. The more important question is temporal: when was BreakoutRoomUserDAO introduced relative to BigBlueButton's adoption of Slick's lifted embeddings? If this predates the migration to injection-safe defaults, it represents legacy persistence code that survived an architectural transition as invisible sediment — a pattern other legacy DAOs likely share. The remediation debt here exceeds the vulnerability debt. Check other DAO files written before or during the Slick migration for raw string interpolation; the probability that this pattern exists elsewhere in unreviewed legacy persistence code is high, and a single CVE fix creates dangerous normalization that the threat model hasn't changed.

Reviewed through automated stages and approved by a human before publication.