The vulnerability in BigBlueButton allows a presenter to submit a presentationId that belongs to another meeting through the /api/graphql endpoint. Because the server does not verify that the requested presentation is associated with the presenter's meeting, an attacker can delete a presentation from any meeting, disrupting its availability. The weakness is an authorization bypass, identified as CWE‑639.

The affected product is BigBlueButton 3.0.29 and earlier. Attackers must have a valid presenter session to submit the request, but they can target any meeting for which they know the presentationId. No other vendors or products are reported to be affected.

The CVSS score is 4.9, indicating a moderate risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is the /api/graphql API using an authenticated presenter session; based on the description, it is inferred that the attacker can supply a presentationId belonging to another meeting. The impact is primarily availability, and the threat level is moderate but still warrants mitigation.