This vulnerability arises from a missing authorization check that allows users with the viewer role to submit or replace captions in BigBlueButton. As a result, a malicious viewer can insert misleading or disruptive captions, potentially spreading misinformation or disrupting the learning experience. The weakness corresponds to CWE-639, an authorization bypass that undermines data integrity.

All BigBlueButton deployments running a version earlier than 3.0.24 are affected, including 3.0.23 and any prior releases. Users who have not applied the 3.0.24 update or later remain vulnerable until the authorization controls are restored.

The CVSS base score of 6.5 indicates moderate to high risk. Since the EPSS score is currently unavailable and the vulnerability is not listed in the CISA KEV catalog, the likelihood of widespread exploitation is uncertain but could emerge through targeted attacks. The flaw can be leveraged by any participant with viewer access, making it a low barrier to exploit. Administrators should treat this as a medium risk that requires timely patching.