Improper privilege management - Anyone can view room settings in GreenLight
Priority LOW 25CWE-269Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Privilege escalation, Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-269 and CWE-863.
Summary
Greenlight is a simple front-end interface for your BigBlueButton server. In affected versions an attacker can view any room's settings even though they are not authorized to do so. Only the room owner and administrator should be able to view a room's settings. This issue has been patched in release version 2.12.6.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0071 53rd percentileScored 2026-11-07
Fix Fixed greenlight (bigbluebutton): 2.12.6
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| bigbluebutton | greenlight | before 2.12.6 | 2.12.6 | Patch available | CNA |
- greenlight Vendorbigbluebutton Affected before 2.12.6 Fixed in 2.12.6 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:bigbluebutton:greenlight:*:*:*:*:*:*:*:* | before 2.12.6 | Vulnerable | bigbluebutton |
- cpe:2.3:a:bigbluebutton:greenlight:*:*:*:*:*:*:*:* Versions before 2.12.6 Vulnerable ·bigbluebutton
Remediation
- Fix · CNA greenlight (bigbluebutton) Fixed in 2.12.6
Timeline
- 2026-10-02 Threatist record created from CVE-2022-31039
References
More bigbluebutton Greenlight vulnerabilities
- TI-2022-16454 BigBlueButton Greenlight Open Redirect vulnerability CVSS 3.1CRITICAL 9.1
- TI-2022-16453 BigBlueButton Greenlight Open Redirect vulnerability CVSS 3.1CRITICAL 9.1
- TI-2020-15996 BigBlueButton Greenlight before 2.5.6 allows HTTP header (Host and Origin) attacks, which… CVSS 3.1HIGH 8.8
- TI-2020-16758 A cross-site scripting (XSS) vulnerability exists in the 'merge account' functionality in… CVSS 3.1MEDIUM 6.1
- TI-2022-09840 BigBlueButton Greenlight 2.11.1 allows XSS. CVSS 3.1MEDIUM 5.4
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences