CVE-2020-27604

CVE-2020-27604 is a medium-severity vulnerability affecting BigBlueButton versions prior to 2.3. It stems from a lack of LibreOffice sandboxing, allowing remote authenticated users to potentially read the API shared secret from the bigbluebutton.properties file. This compromise could enable an attacker to join any meeting, bypassing guest policies. The vulnerability has a CVSS score of 6.5, indicating a network-based attack with low complexity and high confidentiality impact, but no known active exploitation, public exploit code, or significant community discussion.