CVE-2026-46355

The CVE-2026-46355 patch for BigBlueButton 3.0.23 marks handleJoinExistingUser as a 'private helper' — but if that was the entire fix, it's likely ineffective and provides false assurance. In Groovy, the `private` keyword is a visibility hint for documentation and tooling, not a routing barrier. Any controller method in Grails remains routable unless explicitly removed from the static actions property or blocked via interceptors. A developer who added `private` to this method satisfied the CVE paperwork without necessarily closing the attack surface. Before treating this as resolved, verify what the commit actually changed: did it remove handleJoinExistingUser from the routable action map, or did it merely annotate the method? If the fix was cosmetic, the vulnerability persists. This distinction matters because the method's real function — session reuse inheriting an authenticated participant's full context — makes it high-value even with the existingUserID prerequisite. That prerequisite deserves scrutiny too. CVSS 7.1 weights it heavily as a limiting factor (UI:R), but the severity depends on whether existingUserID is enumerable from outside the meeting or requires insider access. In a meeting platform, participant IDs flow through client-side channels and may be obtainable through meeting enumeration or social engineering within a session. An attacker who supplies a valid ID inherits not just a seat in the room but the entire trust graph attached to that participant: moderator permissions, chat history access, presenter control. That's impersonation with depth, not just a bypass. Finally, recognize this as a pattern, not an anomaly. The Grails ecosystem has seen this exact failure — controller methods that should be internal service calls exposed as routable actions — recur across multiple CVEs over the past decade. The fix pattern of 'making it private' perpetuates the misconception that visibility modifiers provide access control in Groovy. Check other ApiController methods in your deployment for the same architectural confusion: session-handling logic that lives in routable controllers when it belongs in the service layer, behind explicit authorization checks, with no routing exposure at all.

Reviewed through automated stages and approved by a human before publication.