CVE-2025-49517: Other users' BigBlueButton recordings accessible in Moodle

BigBlueButton is the video conferencing system Moodle integrates as an activity. Each recording belongs to exactly one such activity and should only be available to the people permitted there.

To start a recording, Moodle looked it up by its identifier across the whole database. The permission check only covered the activity the request came through.

Reported by Vincent Schneider through the Moodle security process, published as MSA-25-0035.

Access to any BigBlueButton activity was enough, the kind a student has in their own course. From there, recordings from other courses could be started.

Sessions the user had never attended became watchable, office hours or lectures from other programmes for example, each with the participants' video and audio.

Because such recordings contain personal data, unauthorised viewing can also amount to a data protection incident.

The activity now only plays what is in its own recording list, which is already filtered by permissions. require_sesskey() now also checks the session token on these requests, as it does when joining or leaving a meeting.