This vulnerability is a blind SQL injection in the refreshBreakoutRoomsVisibleForUsers routine of BigBlueButton. The injection path uses the meetingId and userId parameters that are interpolated directly into database queries. An authenticated moderator can insert arbitrary SQL statements, enabling arbitrary SQL execution against the application database. The flaw could allow an attacker to read, modify, or delete data, compromise authentication tokens, or install backdoors.

The issue affects BigBlueButton installations using any version before 3.0.23. Versions 3.0.0 through 3.0.22 lack the patched input sanitization. The vulnerability resides within the core app component BreakoutRoomUserDAO.scala, part of the akka-bbb-apps module. All deployments that permit moderator role authentication are susceptible.

The CVSS base score of 8.5 indicates high severity, and the exploit is feasible for any moderator who can craft request parameters. While the EPSS score is unavailable, the absence of a KEV listing does not diminish the risk; the weakness is a classic SQL injection (CWE‑89). Attackers would need authenticated access but can gain leverage once a moderator account is compromised, making the attack vector realistic in environments with weak role management.