Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
132 vulnerabilities found for Rocket.Chat by Rocket.Chat
CVE-2026-65645 (GCVE-0-2026-65645)
Vulnerability from nvd – Published: 2026-08-21 02:53 – Updated: 2026-08-21 02:53
VLAI
EPSS
VEX
Summary
Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6. 8.3.8, 8.2.8, 8.1.8, and 7.10.15, the Meteor DDP methods getThreadsList and getThreadMessages accept rid / tmid as raw, untyped parameters with no schema validation. A MongoDB operator object (e.g. {"$gt": "4"}) can be substituted for a string room-id or message-id. The authorization check resolves to a room the attacker already has access to, while the downstream data query fans out across all rooms - disclosing private thread parents and their full reply content to any low-privilege authenticated user.
The REST route chat.getThreadsList was patched in v5.0 (HackerOne report #1446767) by adding rid: {type:'string'} AJV validation. The equivalent DDP method was never given the same fix and remains exploitable
Severity
No CVSS data available.
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Rocket.Chat | Rocket.Chat |
Affected:
0 , < 8.8.0
(semver)
Affected: 0 , < 8.7.1 (semver) Affected: 0 , < 8.6.2 (semver) Affected: 0 , < 8.5.3 (semver) Affected: 0 , < 8.4.6 (semver) Affected: 0 , < 8.3.8 (semver) Affected: 0 , < 8.2.8 (semver) Affected: 0 , < 8.1.8 (semver) Affected: 0 , < 7.10.15 (semver) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Rocket.Chat",
"vendor": "Rocket.Chat",
"versions": [
{
"lessThan": "8.8.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.7.1",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.6.2",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.5.3",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.4.6",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.3.8",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.2.8",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.1.8",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "7.10.15",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Aang (iamaangx028)"
}
],
"descriptions": [
{
"lang": "en",
"value": "Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6. 8.3.8, 8.2.8, 8.1.8, and 7.10.15, the Meteor DDP methods getThreadsList and getThreadMessages accept rid / tmid as raw, untyped parameters with no schema validation. A MongoDB operator object (e.g. {\"$gt\": \"4\"}) can be substituted for a string room-id or message-id. The authorization check resolves to a room the attacker already has access to, while the downstream data query fans out across all rooms - disclosing private thread parents and their full reply content to any low-privilege authenticated user.\nThe REST route chat.getThreadsList was patched in v5.0 (HackerOne report #1446767) by adding rid: {type:\u0027string\u0027} AJV validation. The equivalent DDP method was never given the same fix and remains exploitable"
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T02:53:43.305Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://hackerone.com/reports/3852135"
},
{
"url": "https://github.com/RocketChat/Rocket.Chat/pull/41814"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-65645",
"datePublished": "2026-08-21T02:53:43.305Z",
"dateReserved": "2026-07-22T15:00:06.104Z",
"dateUpdated": "2026-08-21T02:53:43.305Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-65644 (GCVE-0-2026-65644)
Vulnerability from nvd – Published: 2026-08-21 02:53 – Updated: 2026-08-21 02:53
VLAI
EPSS
VEX
Summary
Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, and 7.10.15 has a REST API endpoint POST /api/v1/livechat/visitor that accepts an unauthenticated, unsanitized name field for Livechat visitors. This name is stored raw and later rendered via dangerouslySetInnerHTML in the Omnichannel Queue side panel (InquireSidePanelItem.tsx), injecting a real, clickable HTML link - pointing to any attacker-controlled domain, with arbitrary social-engineering text - into the DOM of any agent viewing the queue.
Severity
No CVSS data available.
CWE
- CWE-79 - Cross-site Scripting (XSS) - DOM
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Rocket.Chat | Rocket.Chat |
Affected:
0 , < 8.8.0
(semver)
Affected: 0 , < 8.7.1 (semver) Affected: 0 , < 8.6.2 (semver) Affected: 0 , < 8.5.3 (semver) Affected: 0 , < 8.4.6 (semver) Affected: 0 , < 8.3.8 (semver) Affected: 0 , < 8.2.8 (semver) Affected: 0 , < 8.1.8 (semver) Affected: 0 , < 7.10.15 (semver) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Rocket.Chat",
"vendor": "Rocket.Chat",
"versions": [
{
"lessThan": "8.8.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.7.1",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.6.2",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.5.3",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.4.6",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.3.8",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.2.8",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.1.8",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "7.10.15",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Hill N (hillng)"
}
],
"descriptions": [
{
"lang": "en",
"value": "Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, and 7.10.15 has a REST API endpoint POST /api/v1/livechat/visitor that accepts an unauthenticated, unsanitized name field for Livechat visitors. This name is stored raw and later rendered via dangerouslySetInnerHTML in the Omnichannel Queue side panel (InquireSidePanelItem.tsx), injecting a real, clickable HTML link - pointing to any attacker-controlled domain, with arbitrary social-engineering text - into the DOM of any agent viewing the queue."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Cross-site Scripting (XSS) - DOM",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T02:53:43.406Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://hackerone.com/reports/3872858"
},
{
"url": "https://github.com/RocketChat/Rocket.Chat/pull/41595"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-65644",
"datePublished": "2026-08-21T02:53:43.406Z",
"dateReserved": "2026-07-22T15:00:06.103Z",
"dateUpdated": "2026-08-21T02:53:43.406Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-56845 (GCVE-0-2026-56845)
Vulnerability from nvd – Published: 2026-08-04 00:43 – Updated: 2026-08-04 15:04
VLAI
EPSS
VEX
Summary
An unauthenticated path traversal (LFI) vulnerability exists under /custom-sounds/ when CustomSounds storage is configured to FileSystem. By including ../ sequences in the request path, an attacker can read arbitrary files outside the base directory.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-04 14:28 UTC
CWE
- CWE-22 - Path Traversal
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Rocket.Chat | Rocket.Chat |
Affected:
0 , < 8.2.0
(semver)
Affected: 0 , < 8.1.1 (semver) Affected: 0 , < 8.0.2 (semver) Affected: 0 , < 7.13.4 (semver) Affected: 0 , < 7.12.5 (semver) Affected: 0 , < 7.11.5 (semver) Affected: 0 , < 7.10.8 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-56845",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-04T14:28:27.555647Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-04T15:04:12.768Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Rocket.Chat",
"vendor": "Rocket.Chat",
"versions": [
{
"lessThan": "8.2.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.1.1",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.0.2",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "7.13.4",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "7.12.5",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "7.11.5",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "7.10.8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "s (howtoplay)"
}
],
"descriptions": [
{
"lang": "en",
"value": "An unauthenticated path traversal (LFI) vulnerability exists under /custom-sounds/ when CustomSounds storage is configured to FileSystem. By including ../ sequences in the request path, an attacker can read arbitrary files outside the base directory."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Path Traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-04T00:43:48.076Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://hackerone.com/reports/3514640"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-56845",
"datePublished": "2026-08-04T00:43:48.076Z",
"dateReserved": "2026-06-23T15:00:03.632Z",
"dateUpdated": "2026-08-04T15:04:12.768Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58066 (GCVE-0-2026-58066)
Vulnerability from nvd – Published: 2026-07-30 06:03 – Updated: 2026-07-31 03:55
VLAI
EPSS
VEX
Summary
Rocket.Chat's SAML SSO before versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8, and 7.10.14 verified XML signatures but did not bind the validated signature to samlp:Response / saml:Assertion. An attacker could submit a wrapped document carrying forged identity attributes alongside any valid signature made by the trusted IdP certificate, and log in as an arbitrary user.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-30 00:00 UTC
CWE
- CWE-287 - Improper Authentication - Generic
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Rocket.Chat | Rocket.Chat |
Affected:
0 , < 8.7.0
(semver)
Affected: 0 , < 8.6.1 (semver) Affected: 0 , < 8.5.2 (semver) Affected: 0 , < 8.4.5 (semver) Affected: 0 , < 8.3.7 (semver) Affected: 0 , < 8.2.7 (semver) Affected: 0 , < 8.1.7 (semver) Affected: 0 , < 8.0.8 (semver) Affected: 0 , < 7.10.14 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-58066",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-30T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T03:55:47.931Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Rocket.Chat",
"vendor": "Rocket.Chat",
"versions": [
{
"lessThan": "8.7.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.6.1",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.5.2",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.4.5",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.3.7",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.2.7",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.1.7",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.0.8",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "7.10.14",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "jayden (0jayden)"
}
],
"descriptions": [
{
"lang": "en",
"value": "Rocket.Chat\u0027s SAML SSO before versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8, and 7.10.14 verified XML signatures but did not bind the validated signature to samlp:Response / saml:Assertion. An attacker could submit a wrapped document carrying forged identity attributes alongside any valid signature made by the trusted IdP certificate, and log in as an arbitrary user."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper Authentication - Generic",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-30T06:03:45.178Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://hackerone.com/reports/3827674"
},
{
"url": "https://github.com/RocketChat/Rocket.Chat/pull/41233"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-58066",
"datePublished": "2026-07-30T06:03:45.178Z",
"dateReserved": "2026-06-28T15:00:00.719Z",
"dateUpdated": "2026-07-31T03:55:47.931Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-48929 (GCVE-0-2026-48929)
Vulnerability from nvd – Published: 2026-06-16 23:08 – Updated: 2026-06-17 15:02
VLAI
EPSS
VEX
Summary
Rocket.Chat in versions <8.5.1, <8.4.4, <8.3.6, <8.2.6, <8.1.6, <8.0.7, <7.13.9, and <7.10.13 is vulnerable to unauthenticated file deletion. The deleteFileMessage Meteor method permanently deletes any uploaded file by ID without requiring authentication. When called via an unauthenticated DDP WebSocket connection, Meteor.userId() returns null, causing the authorization check to be skipped. Execution falls through to FileUpload.getStore('Uploads').deleteById(fileID), which removes the file from storage and database unconditionally. File IDs are discoverable from public channel message payloads and download URLs.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-17 15:02 UTC
CWE
- CWE-287 - Improper Authentication - Generic
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Rocket.Chat | Rocket.Chat |
Affected:
0 , < 8.5.1
(semver)
Affected: 0 , < 8.4.4 (semver) Affected: 0 , < 8.3.6 (semver) Affected: 0 , < 8.2.6 (semver) Affected: 0 , < 8.1.6 (semver) Affected: 0 , < 8.0.7 (semver) Affected: 0 , < 7.13.9 (semver) Affected: 0 , < 7.10.13 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-48929",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-17T15:02:38.629156Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-17T15:02:44.803Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Rocket.Chat",
"vendor": "Rocket.Chat",
"versions": [
{
"lessThan": "8.5.1",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.4.4",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.3.6",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.2.6",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.1.6",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.0.7",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "7.13.9",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "7.10.13",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Rocket.Chat in versions \u003c8.5.1, \u003c8.4.4, \u003c8.3.6, \u003c8.2.6, \u003c8.1.6, \u003c8.0.7, \u003c7.13.9, and \u003c7.10.13 is vulnerable to unauthenticated file deletion. The deleteFileMessage Meteor method permanently deletes any uploaded file by ID without requiring authentication. When called via an unauthenticated DDP WebSocket connection, Meteor.userId() returns null, causing the authorization check to be skipped. Execution falls through to FileUpload.getStore(\u0027Uploads\u0027).deleteById(fileID), which removes the file from storage and database unconditionally. File IDs are discoverable from public channel message payloads and download URLs."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper Authentication - Generic",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-16T23:08:37.888Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://hackerone.com/reports/3611837"
},
{
"url": "https://github.com/RocketChat/Rocket.Chat/pull/40889/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-48929",
"datePublished": "2026-06-16T23:08:37.888Z",
"dateReserved": "2026-05-26T15:00:06.427Z",
"dateUpdated": "2026-06-17T15:02:44.803Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-48616 (GCVE-0-2026-48616)
Vulnerability from nvd – Published: 2026-06-16 23:08 – Updated: 2026-06-17 15:01
VLAI
EPSS
VEX
Summary
Rocket.Chat versions <8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, 7.13.9, 7.10.13 has an access control vulnerability in Livechat files. Protected file downloads at /file-upload/:fileId/:name authorize livechat access using rc_room_type=l with rc_rid+rc_token, but the authorization path does not verify that rc_rid matches the requested file's rid. Furthermore, :fileId is predictable via sequential MongoDB IDs, and :name can be anything, allowing unauthenticated discovery of all uploaded files.
Severity
9.3 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-17 15:01 UTC
CWE
- CWE-284 - Improper Access Control - Generic
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Rocket.Chat | Rocket.Chat |
Affected:
0 , < 8.5.1
(semver)
Affected: 0 , < 8.4.4 (semver) Affected: 0 , < 8.3.6 (semver) Affected: 0 , < 8.2.6 (semver) Affected: 0 , < 8.1.6 (semver) Affected: 0 , < 8.0.7 (semver) Affected: 0 , < 7.13.9 (semver) Affected: 0 , < 7.10.13 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-48616",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-17T15:01:32.537175Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-17T15:01:42.246Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Rocket.Chat",
"vendor": "Rocket.Chat",
"versions": [
{
"lessThan": "8.5.1",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.4.4",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.3.6",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.2.6",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.1.6",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.0.7",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "7.13.9",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "7.10.13",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Rocket.Chat versions \u003c8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, 7.13.9, 7.10.13 has an access control vulnerability in Livechat files. Protected file downloads at /file-upload/:fileId/:name authorize livechat access using rc_room_type=l with rc_rid+rc_token, but the authorization path does not verify that rc_rid matches the requested file\u0027s rid. Furthermore, :fileId is predictable via sequential MongoDB IDs, and :name can be anything, allowing unauthenticated discovery of all uploaded files."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control - Generic",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-16T23:08:37.908Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://hackerone.com/reports/3687142"
},
{
"url": "https://github.com/RocketChat/Rocket.Chat/pull/40889"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-48616",
"datePublished": "2026-06-16T23:08:37.908Z",
"dateReserved": "2026-05-22T15:00:09.276Z",
"dateUpdated": "2026-06-17T15:01:42.246Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-32995 (GCVE-0-2026-32995)
Vulnerability from nvd – Published: 2026-05-28 04:01 – Updated: 2026-05-28 13:13
VLAI
EPSS
VEX
Summary
The Rocket.Chat DDP method autoTranslate.translateMessage in versions <8.5.0, <8.4.2, <8.3.4, <8.2.4, <8.1.5, <8.0.5, <7.13.8, and <7.10.12 accepts a client-supplied IMessage object and passes it directly to translateMessage() without checking Meteor.userId() or verifying room membership. Any authenticated DDP user can read the content of any message by ID from any room (private channels, DMs, E2EE rooms) by calling this method.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-28 13:13 UTC
CWE
- CWE-284 - Improper Access Control - Generic
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Rocket.Chat | Rocket.Chat |
Affected:
8.5.0 , < 8.5.0
(semver)
Affected: 8.4.0 , < 8.4.2 (semver) Affected: 8.3.0 , < 8.3.4 (semver) Affected: 8.2.0 , < 8.2.4 (semver) Affected: 8.1.0 , < 8.1.5 (semver) Affected: 8.0.0 , < 8.0.6 (semver) Affected: 7.13.0 , < 7.13.8 (semver) Affected: 7.10.0 , < 7.10.12 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-32995",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-28T13:13:28.908184Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-28T13:13:36.583Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Rocket.Chat",
"vendor": "Rocket.Chat",
"versions": [
{
"lessThan": "8.5.0",
"status": "affected",
"version": "8.5.0",
"versionType": "semver"
},
{
"lessThan": "8.4.2",
"status": "affected",
"version": "8.4.0",
"versionType": "semver"
},
{
"lessThan": "8.3.4",
"status": "affected",
"version": "8.3.0",
"versionType": "semver"
},
{
"lessThan": "8.2.4",
"status": "affected",
"version": "8.2.0",
"versionType": "semver"
},
{
"lessThan": "8.1.5",
"status": "affected",
"version": "8.1.0",
"versionType": "semver"
},
{
"lessThan": "8.0.6",
"status": "affected",
"version": "8.0.0",
"versionType": "semver"
},
{
"lessThan": "7.13.8",
"status": "affected",
"version": "7.13.0",
"versionType": "semver"
},
{
"lessThan": "7.10.12",
"status": "affected",
"version": "7.10.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Rocket.Chat DDP method autoTranslate.translateMessage in versions \u003c8.5.0, \u003c8.4.2, \u003c8.3.4, \u003c8.2.4, \u003c8.1.5, \u003c8.0.5, \u003c7.13.8, and \u003c7.10.12 accepts a client-supplied IMessage object and passes it directly to translateMessage() without checking Meteor.userId() or verifying room membership. Any authenticated DDP user can read the content of any message by ID from any room (private channels, DMs, E2EE rooms) by calling this method."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control - Generic",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-28T04:01:37.645Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://hackerone.com/reports/3734326"
},
{
"url": "https://github.com/RocketChat/Rocket.Chat/pull/40528"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-32995",
"datePublished": "2026-05-28T04:01:37.645Z",
"dateReserved": "2026-03-17T15:00:07.746Z",
"dateUpdated": "2026-05-28T13:13:36.583Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-32994 (GCVE-0-2026-32994)
Vulnerability from nvd – Published: 2026-05-19 04:43 – Updated: 2026-05-19 12:36
VLAI
EPSS
VEX
Summary
The /api/v1/autotranslate.translateMessage endpoint in versions <8.5.0, <8.4.2, <8.3.4, <8.2.4, <8.1.5, <8.0.6, <7.13.8, and <7.10.12 allows any authenticated user to retrieve the full content of any message from any room (private groups, direct messages, channels) by simply providing the target message ID. The endpoint fetches the message via Messages.findOneById(messageId) with no room access check (canAccessRoomIdAsync is never called), returning the complete IMessage object including message text, sender info, room ID, timestamps, and markdown content.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-19 12:36 UTC
CWE
- CWE-284 - Improper Access Control - Generic
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Rocket.Chat | Rocket.Chat |
Affected:
0 , < 8.5.0
(semver)
Affected: 0 , < 8.4.2 (semver) Affected: 0 , < 8.3.4 (semver) Affected: 0 , < 8.2.4 (semver) Affected: 0 , < 8.1.5 (semver) Affected: 0 , < 8.0.6 (semver) Affected: 0 , < 7.13.8 (semver) Affected: 0 , < 7.10.12 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-32994",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-19T12:36:21.168251Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-19T12:36:27.839Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Rocket.Chat",
"vendor": "Rocket.Chat",
"versions": [
{
"lessThan": "8.5.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.4.2",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.3.4",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.2.4",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.1.5",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.0.6",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "7.13.8",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "7.10.12",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The /api/v1/autotranslate.translateMessage endpoint in versions \u003c8.5.0, \u003c8.4.2, \u003c8.3.4, \u003c8.2.4, \u003c8.1.5, \u003c8.0.6, \u003c7.13.8, and \u003c7.10.12 allows any authenticated user to retrieve the full content of any message from any room (private groups, direct messages, channels) by simply providing the target message ID. The endpoint fetches the message via Messages.findOneById(messageId) with no room access check (canAccessRoomIdAsync is never called), returning the complete IMessage object including message text, sender info, room ID, timestamps, and markdown content."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control - Generic",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-19T04:43:41.777Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://hackerone.com/reports/3713682"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-32994",
"datePublished": "2026-05-19T04:43:41.777Z",
"dateReserved": "2026-03-17T15:00:07.746Z",
"dateUpdated": "2026-05-19T12:36:27.839Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-29197 (GCVE-0-2026-29197)
Vulnerability from nvd – Published: 2026-04-23 23:19 – Updated: 2026-04-24 14:18
VLAI
EPSS
VEX
Summary
In versions <8.4.0, <8.3.2, <8.2.2, <8.1.3, <8.0.4, <7.13.6, <7.12.7, <7.11.7, and <7.10.10, the endpoints /api/apps/logs and /api/apps/:id/logs have a typo in the required permission check, allowing authenticated users without the proper permissions to read apps-engine logs.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-24 14:17 UTC
CWE
- CWE-284 - Improper Access Control - Generic
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Rocket.Chat | Rocket.Chat |
Affected:
8.4.0 , < 8.4.0
(semver)
Affected: 8.3.2 , < 8.3.2 (semver) Affected: 8.2.2 , < 8.2.2 (semver) Affected: 8.1.3 , < 8.1.3 (semver) Affected: 8.0.4 , < 8.0.4 (semver) Affected: 7.13.6 , < 7.13.6 (semver) Affected: 7.12.7 , < 7.12.7 (semver) Affected: 7.11.7 , < 7.11.7 (semver) Affected: 7.10.10 , < 7.10.10 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-29197",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-24T14:17:53.996452Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T14:18:07.117Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Rocket.Chat",
"vendor": "Rocket.Chat",
"versions": [
{
"lessThan": "8.4.0",
"status": "affected",
"version": "8.4.0",
"versionType": "semver"
},
{
"lessThan": "8.3.2",
"status": "affected",
"version": "8.3.2",
"versionType": "semver"
},
{
"lessThan": "8.2.2",
"status": "affected",
"version": "8.2.2",
"versionType": "semver"
},
{
"lessThan": "8.1.3",
"status": "affected",
"version": "8.1.3",
"versionType": "semver"
},
{
"lessThan": "8.0.4",
"status": "affected",
"version": "8.0.4",
"versionType": "semver"
},
{
"lessThan": "7.13.6",
"status": "affected",
"version": "7.13.6",
"versionType": "semver"
},
{
"lessThan": "7.12.7",
"status": "affected",
"version": "7.12.7",
"versionType": "semver"
},
{
"lessThan": "7.11.7",
"status": "affected",
"version": "7.11.7",
"versionType": "semver"
},
{
"lessThan": "7.10.10",
"status": "affected",
"version": "7.10.10",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In versions \u003c8.4.0, \u003c8.3.2, \u003c8.2.2, \u003c8.1.3, \u003c8.0.4, \u003c7.13.6, \u003c7.12.7, \u003c7.11.7, and \u003c7.10.10, the endpoints /api/apps/logs and /api/apps/:id/logs have a typo in the required permission check, allowing authenticated users without the proper permissions to read apps-engine logs."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control - Generic",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-23T23:19:40.722Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://hackerone.com/reports/3589551"
},
{
"url": "https://github.com/RocketChat/Rocket.Chat/pull/40125"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-29197",
"datePublished": "2026-04-23T23:19:40.722Z",
"dateReserved": "2026-03-04T15:00:09.266Z",
"dateUpdated": "2026-04-24T14:18:07.117Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-29198 (GCVE-0-2026-29198)
Vulnerability from nvd – Published: 2026-04-22 23:30 – Updated: 2026-04-23 17:41
VLAI
EPSS
VEX
Summary
In Rocket.Chat <8.3.0, <8.2.1, <8.1.2, <8.0.3, <7.13.5, <7.12.6, <7.11.6, and <7.10.9, a NoSQL injection vulnerability can lead to account takeover of the first user with a generated token when an OAuth app is configured.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-23 17:41 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Rocket.Chat | Rocket.Chat |
Unaffected:
8.3.0 , < 8.3.0
(semver)
Unaffected: 8.2.1 , < 8.2.1 (semver) Unaffected: 8.0.3 , < 8.0.3 (semver) Unaffected: 7.13.5 , < 7.13.5 (semver) Unaffected: 7.12.6 , < 7.12.6 (semver) Unaffected: 7.11.6 , < 7.11.6 (semver) Unaffected: 7.10.9 , < 7.10.9 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-29198",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-23T17:41:26.415612Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-23T17:41:50.981Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Rocket.Chat",
"vendor": "Rocket.Chat",
"versions": [
{
"lessThan": "8.3.0",
"status": "unaffected",
"version": "8.3.0",
"versionType": "semver"
},
{
"lessThan": "8.2.1",
"status": "unaffected",
"version": "8.2.1",
"versionType": "semver"
},
{
"lessThan": "8.0.3",
"status": "unaffected",
"version": "8.0.3",
"versionType": "semver"
},
{
"lessThan": "7.13.5",
"status": "unaffected",
"version": "7.13.5",
"versionType": "semver"
},
{
"lessThan": "7.12.6",
"status": "unaffected",
"version": "7.12.6",
"versionType": "semver"
},
{
"lessThan": "7.11.6",
"status": "unaffected",
"version": "7.11.6",
"versionType": "semver"
},
{
"lessThan": "7.10.9",
"status": "unaffected",
"version": "7.10.9",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In Rocket.Chat \u003c8.3.0, \u003c8.2.1, \u003c8.1.2, \u003c8.0.3, \u003c7.13.5, \u003c7.12.6, \u003c7.11.6, and \u003c7.10.9, a NoSQL injection vulnerability can lead to account takeover of the first user with a generated token when an OAuth app is configured."
}
],
"providerMetadata": {
"dateUpdated": "2026-04-22T23:30:15.355Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://hackerone.com/reports/3564655"
},
{
"url": "https://github.com/RocketChat/Rocket.Chat/pull/39492"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-29198",
"datePublished": "2026-04-22T23:30:15.355Z",
"dateReserved": "2026-03-04T15:00:09.266Z",
"dateUpdated": "2026-04-23T17:41:50.981Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-22560 (GCVE-0-2026-22560)
Vulnerability from nvd – Published: 2026-04-10 17:00 – Updated: 2026-04-14 19:04
VLAI
EPSS
VEX
Summary
An open redirect vulnerability in Rocket.Chat versions prior to 8.4.0 allows users to be redirected to arbitrary URLs by manipulating parameters within a SAML endpoint.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-14 19:04 UTC
CWE
- CWE-601 - Open Redirect
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Rocket.Chat | Rocket.Chat |
Affected:
8.4.0 , < 8.4.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-22560",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-14T19:04:29.881437Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-14T19:04:32.571Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Rocket.Chat",
"vendor": "Rocket.Chat",
"versions": [
{
"lessThan": "8.4.0",
"status": "affected",
"version": "8.4.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An open redirect vulnerability in Rocket.Chat versions prior to 8.4.0 allows users to be redirected to arbitrary URLs by manipulating parameters within a SAML endpoint."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601 Open Redirect",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-10T17:00:11.746Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://hackerone.com/reports/3418031"
},
{
"url": "https://github.com/RocketChat/Rocket.Chat/pull/38994"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-22560",
"datePublished": "2026-04-10T17:00:11.746Z",
"dateReserved": "2026-01-07T15:39:03.440Z",
"dateUpdated": "2026-04-14T19:04:32.571Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-30833 (GCVE-0-2026-30833)
Vulnerability from nvd – Published: 2026-03-06 17:40 – Updated: 2026-03-09 14:56
VLAI
EPSS
VEX
Title
Rocket.Chat: NoSQL injection in the EE ddp-streamer-service
Summary
Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to versions 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1, and 8.2.0, a NoSQL injection vulnerability exists in Rocket.Chat's account service used in the ddp-streamer micro service that allows unauthenticated attackers to manipulate MongoDB queries during authentication. The vulnerability is located in the username-based login flow where user-supplied input is directly embedded into a MongoDB query selector without validation. An attacker can inject MongoDB operator expressions (e.g., { $regex: '.*' }) in place of a username string, causing the database query to match unintended user records. This issue has been patched in versions 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1, and 8.2.0.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-09 14:55 UTC
CWE
- CWE-943 - Improper Neutralization of Special Elements in Data Query Logic
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/RocketChat/Rocket.Chat/securit… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| RocketChat | Rocket.Chat |
Affected:
< 7.10.8
Affected: < 7.11.5 Affected: < 7.12.5 Affected: < 7.13.4 Affected: < 8.0.2 Affected: < 8.1.1 Affected: < 8.2.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-30833",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-09T14:55:56.507627Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-09T14:56:03.564Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Rocket.Chat",
"vendor": "RocketChat",
"versions": [
{
"status": "affected",
"version": "\u003c 7.10.8"
},
{
"status": "affected",
"version": "\u003c 7.11.5"
},
{
"status": "affected",
"version": "\u003c 7.12.5"
},
{
"status": "affected",
"version": "\u003c 7.13.4"
},
{
"status": "affected",
"version": "\u003c 8.0.2"
},
{
"status": "affected",
"version": "\u003c 8.1.1"
},
{
"status": "affected",
"version": "\u003c 8.2.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to versions 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1, and 8.2.0, a NoSQL injection vulnerability exists in Rocket.Chat\u0027s account service used in the ddp-streamer micro service that allows unauthenticated attackers to manipulate MongoDB queries during authentication. The vulnerability is located in the username-based login flow where user-supplied input is directly embedded into a MongoDB query selector without validation. An attacker can inject MongoDB operator expressions (e.g., { $regex: \u0027.*\u0027 }) in place of a username string, causing the database query to match unintended user records. This issue has been patched in versions 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1, and 8.2.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-943",
"description": "CWE-943: Improper Neutralization of Special Elements in Data Query Logic",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-06T17:40:36.939Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-hgq6-9jg2-wf3f",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-hgq6-9jg2-wf3f"
}
],
"source": {
"advisory": "GHSA-hgq6-9jg2-wf3f",
"discovery": "UNKNOWN"
},
"title": "Rocket.Chat: NoSQL injection in the EE ddp-streamer-service"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-30833",
"datePublished": "2026-03-06T17:40:36.939Z",
"dateReserved": "2026-03-05T21:06:44.606Z",
"dateUpdated": "2026-03-09T14:56:03.564Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-30831 (GCVE-0-2026-30831)
Vulnerability from nvd – Published: 2026-03-06 17:40 – Updated: 2026-03-11 03:56
VLAI
EPSS
VEX
Title
Rocket.Chat: 2FA bypass and login of deactivated users via EE ddp-streamer
Summary
Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to versions 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1, and 8.2.0, authentication vulnerabilities exist in Rocket.Chat's enterprise DDP Streamer service. The Account.login method exposed through the DDP Streamer does not enforce Two-Factor Authentication (2FA) or validate user account status (deactivated users can still login), despite these checks being mandatory in the standard Meteor login flow. This issue has been patched in versions 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1, and 8.2.0.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-10 00:00 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/RocketChat/Rocket.Chat/securit… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| RocketChat | Rocket.Chat |
Affected:
< 7.10.8
Affected: < 7.11.5 Affected: < 7.12.5 Affected: < 7.13.4 Affected: < 8.0.2 Affected: < 8.1.1 Affected: < 8.2.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-30831",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-10T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-11T03:56:34.815Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Rocket.Chat",
"vendor": "RocketChat",
"versions": [
{
"status": "affected",
"version": "\u003c 7.10.8"
},
{
"status": "affected",
"version": "\u003c 7.11.5"
},
{
"status": "affected",
"version": "\u003c 7.12.5"
},
{
"status": "affected",
"version": "\u003c 7.13.4"
},
{
"status": "affected",
"version": "\u003c 8.0.2"
},
{
"status": "affected",
"version": "\u003c 8.1.1"
},
{
"status": "affected",
"version": "\u003c 8.2.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to versions 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1, and 8.2.0, authentication vulnerabilities exist in Rocket.Chat\u0027s enterprise DDP Streamer service. The Account.login method exposed through the DDP Streamer does not enforce Two-Factor Authentication (2FA) or validate user account status (deactivated users can still login), despite these checks being mandatory in the standard Meteor login flow. This issue has been patched in versions 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1, and 8.2.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287: Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-304",
"description": "CWE-304: Missing Critical Step in Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-06T17:40:27.824Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-7qr6-q62g-hm63",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-7qr6-q62g-hm63"
}
],
"source": {
"advisory": "GHSA-7qr6-q62g-hm63",
"discovery": "UNKNOWN"
},
"title": "Rocket.Chat: 2FA bypass and login of deactivated users via EE ddp-streamer"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-30831",
"datePublished": "2026-03-06T17:40:27.824Z",
"dateReserved": "2026-03-05T21:06:44.606Z",
"dateUpdated": "2026-03-11T03:56:34.815Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-28514 (GCVE-0-2026-28514)
Vulnerability from nvd – Published: 2026-03-06 17:35 – Updated: 2026-03-11 03:56
VLAI
EPSS
VEX
Title
Rocket.Chat: Users can login with any password via the EE ddp-streamer-service
Summary
Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to versions 7.8.6, 7.9.8, 7.10.7, 7.11.4, 7.12.4, 7.13.3, and 8.0.0, a critical authentication bypass vulnerability exists in Rocket.Chat's account service used in the ddp-streamer micro service that allows an attacker to log in to the service as any user with a password set, using any arbitrary password. The vulnerability stems from a missing await keyword when calling an asynchronous password validation function, causing a Promise object (which is always truthy) to be evaluated instead of the actual boolean validation result. This may lead to account takeover of any user whose username is known or guessable. This issue has been patched in versions 7.8.6, 7.9.8, 7.10.7, 7.11.4, 7.12.4, 7.13.3, and 8.0.0.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-10 00:00 UTC
CWE
- CWE-287 - Improper Authentication
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/RocketChat/Rocket.Chat/securit… | x_refsource_CONFIRM |
| https://github.com/RocketChat/Rocket.Chat/pull/37143 | x_refsource_MISC |
| https://github.com/RocketChat/Rocket.Chat/commit/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| RocketChat | Rocket.Chat |
Affected:
< 7.8.6
Affected: < 7.9.8 Affected: < 7.10.7 Affected: < 7.11.4 Affected: < 7.12.4 Affected: < 7.13.3 Affected: < 8.0.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-28514",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-10T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-11T03:56:35.920Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Rocket.Chat",
"vendor": "RocketChat",
"versions": [
{
"status": "affected",
"version": "\u003c 7.8.6"
},
{
"status": "affected",
"version": "\u003c 7.9.8"
},
{
"status": "affected",
"version": "\u003c 7.10.7"
},
{
"status": "affected",
"version": "\u003c 7.11.4"
},
{
"status": "affected",
"version": "\u003c 7.12.4"
},
{
"status": "affected",
"version": "\u003c 7.13.3"
},
{
"status": "affected",
"version": "\u003c 8.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to versions 7.8.6, 7.9.8, 7.10.7, 7.11.4, 7.12.4, 7.13.3, and 8.0.0, a critical authentication bypass vulnerability exists in Rocket.Chat\u0027s account service used in the ddp-streamer micro service that allows an attacker to log in to the service as any user with a password set, using any arbitrary password. The vulnerability stems from a missing await keyword when calling an asynchronous password validation function, causing a Promise object (which is always truthy) to be evaluated instead of the actual boolean validation result. This may lead to account takeover of any user whose username is known or guessable. This issue has been patched in versions 7.8.6, 7.9.8, 7.10.7, 7.11.4, 7.12.4, 7.13.3, and 8.0.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287: Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-06T17:35:01.841Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-w6vw-mrgv-69vf",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-w6vw-mrgv-69vf"
},
{
"name": "https://github.com/RocketChat/Rocket.Chat/pull/37143",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/RocketChat/Rocket.Chat/pull/37143"
},
{
"name": "https://github.com/RocketChat/Rocket.Chat/commit/7d89aae0b1bd08e82b02ceab4c180b430e2c6f07",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/RocketChat/Rocket.Chat/commit/7d89aae0b1bd08e82b02ceab4c180b430e2c6f07"
}
],
"source": {
"advisory": "GHSA-w6vw-mrgv-69vf",
"discovery": "UNKNOWN"
},
"title": "Rocket.Chat: Users can login with any password via the EE ddp-streamer-service"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-28514",
"datePublished": "2026-03-06T17:35:01.841Z",
"dateReserved": "2026-02-27T20:57:47.710Z",
"dateUpdated": "2026-03-11T03:56:35.920Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23477 (GCVE-0-2026-23477)
Vulnerability from nvd – Published: 2026-01-14 18:16 – Updated: 2026-01-14 21:14
VLAI
EPSS
VEX
Title
Rocket.Chat Unauthorized Access to OAuth App Details
Summary
Rocket.Chat is an open-source, secure, fully customizable communications platform. In Rocket.Chat versions up to 6.12.0, the API endpoint GET /api/v1/oauth-apps.get is exposed to any authenticated user, regardless of their role or permissions. This endpoint returns an OAuth application, as long as the user knows its ID, including potentially sensitive fields such as client_id and client_secret. This vulnerability is fixed in 6.12.0.
Severity
7.7 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-14 21:13 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/RocketChat/Rocket.Chat/securit… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| RocketChat | Rocket.Chat |
Affected:
< 6.12.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-23477",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-14T21:13:59.771321Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-14T21:14:08.081Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Rocket.Chat",
"vendor": "RocketChat",
"versions": [
{
"status": "affected",
"version": "\u003c 6.12.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Rocket.Chat is an open-source, secure, fully customizable communications platform. In Rocket.Chat versions up to 6.12.0, the API endpoint GET /api/v1/oauth-apps.get is exposed to any authenticated user, regardless of their role or permissions. This endpoint returns an OAuth application, as long as the user knows its ID, including potentially sensitive fields such as client_id and client_secret. This vulnerability is fixed in 6.12.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269: Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-14T18:16:05.178Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-g4wm-fg3c-g4p2",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-g4wm-fg3c-g4p2"
}
],
"source": {
"advisory": "GHSA-g4wm-fg3c-g4p2",
"discovery": "UNKNOWN"
},
"title": "Rocket.Chat Unauthorized Access to OAuth App Details"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-23477",
"datePublished": "2026-01-14T18:16:05.178Z",
"dateReserved": "2026-01-13T15:47:41.627Z",
"dateUpdated": "2026-01-14T21:14:08.081Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-65644 (GCVE-0-2026-65644)
Vulnerability from cvelistv5 – Published: 2026-08-21 02:53 – Updated: 2026-08-21 02:53
VLAI
EPSS
VEX
Summary
Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, and 7.10.15 has a REST API endpoint POST /api/v1/livechat/visitor that accepts an unauthenticated, unsanitized name field for Livechat visitors. This name is stored raw and later rendered via dangerouslySetInnerHTML in the Omnichannel Queue side panel (InquireSidePanelItem.tsx), injecting a real, clickable HTML link - pointing to any attacker-controlled domain, with arbitrary social-engineering text - into the DOM of any agent viewing the queue.
Severity
No CVSS data available.
CWE
- CWE-79 - Cross-site Scripting (XSS) - DOM
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Rocket.Chat | Rocket.Chat |
Affected:
0 , < 8.8.0
(semver)
Affected: 0 , < 8.7.1 (semver) Affected: 0 , < 8.6.2 (semver) Affected: 0 , < 8.5.3 (semver) Affected: 0 , < 8.4.6 (semver) Affected: 0 , < 8.3.8 (semver) Affected: 0 , < 8.2.8 (semver) Affected: 0 , < 8.1.8 (semver) Affected: 0 , < 7.10.15 (semver) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Rocket.Chat",
"vendor": "Rocket.Chat",
"versions": [
{
"lessThan": "8.8.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.7.1",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.6.2",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.5.3",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.4.6",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.3.8",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.2.8",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.1.8",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "7.10.15",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Hill N (hillng)"
}
],
"descriptions": [
{
"lang": "en",
"value": "Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, and 7.10.15 has a REST API endpoint POST /api/v1/livechat/visitor that accepts an unauthenticated, unsanitized name field for Livechat visitors. This name is stored raw and later rendered via dangerouslySetInnerHTML in the Omnichannel Queue side panel (InquireSidePanelItem.tsx), injecting a real, clickable HTML link - pointing to any attacker-controlled domain, with arbitrary social-engineering text - into the DOM of any agent viewing the queue."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Cross-site Scripting (XSS) - DOM",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T02:53:43.406Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://hackerone.com/reports/3872858"
},
{
"url": "https://github.com/RocketChat/Rocket.Chat/pull/41595"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-65644",
"datePublished": "2026-08-21T02:53:43.406Z",
"dateReserved": "2026-07-22T15:00:06.103Z",
"dateUpdated": "2026-08-21T02:53:43.406Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-65645 (GCVE-0-2026-65645)
Vulnerability from cvelistv5 – Published: 2026-08-21 02:53 – Updated: 2026-08-21 02:53
VLAI
EPSS
VEX
Summary
Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6. 8.3.8, 8.2.8, 8.1.8, and 7.10.15, the Meteor DDP methods getThreadsList and getThreadMessages accept rid / tmid as raw, untyped parameters with no schema validation. A MongoDB operator object (e.g. {"$gt": "4"}) can be substituted for a string room-id or message-id. The authorization check resolves to a room the attacker already has access to, while the downstream data query fans out across all rooms - disclosing private thread parents and their full reply content to any low-privilege authenticated user.
The REST route chat.getThreadsList was patched in v5.0 (HackerOne report #1446767) by adding rid: {type:'string'} AJV validation. The equivalent DDP method was never given the same fix and remains exploitable
Severity
No CVSS data available.
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Rocket.Chat | Rocket.Chat |
Affected:
0 , < 8.8.0
(semver)
Affected: 0 , < 8.7.1 (semver) Affected: 0 , < 8.6.2 (semver) Affected: 0 , < 8.5.3 (semver) Affected: 0 , < 8.4.6 (semver) Affected: 0 , < 8.3.8 (semver) Affected: 0 , < 8.2.8 (semver) Affected: 0 , < 8.1.8 (semver) Affected: 0 , < 7.10.15 (semver) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Rocket.Chat",
"vendor": "Rocket.Chat",
"versions": [
{
"lessThan": "8.8.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.7.1",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.6.2",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.5.3",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.4.6",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.3.8",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.2.8",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.1.8",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "7.10.15",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Aang (iamaangx028)"
}
],
"descriptions": [
{
"lang": "en",
"value": "Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6. 8.3.8, 8.2.8, 8.1.8, and 7.10.15, the Meteor DDP methods getThreadsList and getThreadMessages accept rid / tmid as raw, untyped parameters with no schema validation. A MongoDB operator object (e.g. {\"$gt\": \"4\"}) can be substituted for a string room-id or message-id. The authorization check resolves to a room the attacker already has access to, while the downstream data query fans out across all rooms - disclosing private thread parents and their full reply content to any low-privilege authenticated user.\nThe REST route chat.getThreadsList was patched in v5.0 (HackerOne report #1446767) by adding rid: {type:\u0027string\u0027} AJV validation. The equivalent DDP method was never given the same fix and remains exploitable"
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T02:53:43.305Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://hackerone.com/reports/3852135"
},
{
"url": "https://github.com/RocketChat/Rocket.Chat/pull/41814"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-65645",
"datePublished": "2026-08-21T02:53:43.305Z",
"dateReserved": "2026-07-22T15:00:06.104Z",
"dateUpdated": "2026-08-21T02:53:43.305Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-56845 (GCVE-0-2026-56845)
Vulnerability from cvelistv5 – Published: 2026-08-04 00:43 – Updated: 2026-08-04 15:04
VLAI
EPSS
VEX
Summary
An unauthenticated path traversal (LFI) vulnerability exists under /custom-sounds/ when CustomSounds storage is configured to FileSystem. By including ../ sequences in the request path, an attacker can read arbitrary files outside the base directory.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-04 14:28 UTC
CWE
- CWE-22 - Path Traversal
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Rocket.Chat | Rocket.Chat |
Affected:
0 , < 8.2.0
(semver)
Affected: 0 , < 8.1.1 (semver) Affected: 0 , < 8.0.2 (semver) Affected: 0 , < 7.13.4 (semver) Affected: 0 , < 7.12.5 (semver) Affected: 0 , < 7.11.5 (semver) Affected: 0 , < 7.10.8 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-56845",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-04T14:28:27.555647Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-04T15:04:12.768Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Rocket.Chat",
"vendor": "Rocket.Chat",
"versions": [
{
"lessThan": "8.2.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.1.1",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.0.2",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "7.13.4",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "7.12.5",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "7.11.5",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "7.10.8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "s (howtoplay)"
}
],
"descriptions": [
{
"lang": "en",
"value": "An unauthenticated path traversal (LFI) vulnerability exists under /custom-sounds/ when CustomSounds storage is configured to FileSystem. By including ../ sequences in the request path, an attacker can read arbitrary files outside the base directory."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Path Traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-04T00:43:48.076Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://hackerone.com/reports/3514640"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-56845",
"datePublished": "2026-08-04T00:43:48.076Z",
"dateReserved": "2026-06-23T15:00:03.632Z",
"dateUpdated": "2026-08-04T15:04:12.768Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58066 (GCVE-0-2026-58066)
Vulnerability from cvelistv5 – Published: 2026-07-30 06:03 – Updated: 2026-07-31 03:55
VLAI
EPSS
VEX
Summary
Rocket.Chat's SAML SSO before versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8, and 7.10.14 verified XML signatures but did not bind the validated signature to samlp:Response / saml:Assertion. An attacker could submit a wrapped document carrying forged identity attributes alongside any valid signature made by the trusted IdP certificate, and log in as an arbitrary user.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-30 00:00 UTC
CWE
- CWE-287 - Improper Authentication - Generic
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Rocket.Chat | Rocket.Chat |
Affected:
0 , < 8.7.0
(semver)
Affected: 0 , < 8.6.1 (semver) Affected: 0 , < 8.5.2 (semver) Affected: 0 , < 8.4.5 (semver) Affected: 0 , < 8.3.7 (semver) Affected: 0 , < 8.2.7 (semver) Affected: 0 , < 8.1.7 (semver) Affected: 0 , < 8.0.8 (semver) Affected: 0 , < 7.10.14 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-58066",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-30T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T03:55:47.931Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Rocket.Chat",
"vendor": "Rocket.Chat",
"versions": [
{
"lessThan": "8.7.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.6.1",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.5.2",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.4.5",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.3.7",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.2.7",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.1.7",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.0.8",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "7.10.14",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "jayden (0jayden)"
}
],
"descriptions": [
{
"lang": "en",
"value": "Rocket.Chat\u0027s SAML SSO before versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8, and 7.10.14 verified XML signatures but did not bind the validated signature to samlp:Response / saml:Assertion. An attacker could submit a wrapped document carrying forged identity attributes alongside any valid signature made by the trusted IdP certificate, and log in as an arbitrary user."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper Authentication - Generic",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-30T06:03:45.178Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://hackerone.com/reports/3827674"
},
{
"url": "https://github.com/RocketChat/Rocket.Chat/pull/41233"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-58066",
"datePublished": "2026-07-30T06:03:45.178Z",
"dateReserved": "2026-06-28T15:00:00.719Z",
"dateUpdated": "2026-07-31T03:55:47.931Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-48616 (GCVE-0-2026-48616)
Vulnerability from cvelistv5 – Published: 2026-06-16 23:08 – Updated: 2026-06-17 15:01
VLAI
EPSS
VEX
Summary
Rocket.Chat versions <8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, 7.13.9, 7.10.13 has an access control vulnerability in Livechat files. Protected file downloads at /file-upload/:fileId/:name authorize livechat access using rc_room_type=l with rc_rid+rc_token, but the authorization path does not verify that rc_rid matches the requested file's rid. Furthermore, :fileId is predictable via sequential MongoDB IDs, and :name can be anything, allowing unauthenticated discovery of all uploaded files.
Severity
9.3 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-17 15:01 UTC
CWE
- CWE-284 - Improper Access Control - Generic
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Rocket.Chat | Rocket.Chat |
Affected:
0 , < 8.5.1
(semver)
Affected: 0 , < 8.4.4 (semver) Affected: 0 , < 8.3.6 (semver) Affected: 0 , < 8.2.6 (semver) Affected: 0 , < 8.1.6 (semver) Affected: 0 , < 8.0.7 (semver) Affected: 0 , < 7.13.9 (semver) Affected: 0 , < 7.10.13 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-48616",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-17T15:01:32.537175Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-17T15:01:42.246Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Rocket.Chat",
"vendor": "Rocket.Chat",
"versions": [
{
"lessThan": "8.5.1",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.4.4",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.3.6",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.2.6",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.1.6",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.0.7",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "7.13.9",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "7.10.13",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Rocket.Chat versions \u003c8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, 7.13.9, 7.10.13 has an access control vulnerability in Livechat files. Protected file downloads at /file-upload/:fileId/:name authorize livechat access using rc_room_type=l with rc_rid+rc_token, but the authorization path does not verify that rc_rid matches the requested file\u0027s rid. Furthermore, :fileId is predictable via sequential MongoDB IDs, and :name can be anything, allowing unauthenticated discovery of all uploaded files."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control - Generic",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-16T23:08:37.908Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://hackerone.com/reports/3687142"
},
{
"url": "https://github.com/RocketChat/Rocket.Chat/pull/40889"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-48616",
"datePublished": "2026-06-16T23:08:37.908Z",
"dateReserved": "2026-05-22T15:00:09.276Z",
"dateUpdated": "2026-06-17T15:01:42.246Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-48929 (GCVE-0-2026-48929)
Vulnerability from cvelistv5 – Published: 2026-06-16 23:08 – Updated: 2026-06-17 15:02
VLAI
EPSS
VEX
Summary
Rocket.Chat in versions <8.5.1, <8.4.4, <8.3.6, <8.2.6, <8.1.6, <8.0.7, <7.13.9, and <7.10.13 is vulnerable to unauthenticated file deletion. The deleteFileMessage Meteor method permanently deletes any uploaded file by ID without requiring authentication. When called via an unauthenticated DDP WebSocket connection, Meteor.userId() returns null, causing the authorization check to be skipped. Execution falls through to FileUpload.getStore('Uploads').deleteById(fileID), which removes the file from storage and database unconditionally. File IDs are discoverable from public channel message payloads and download URLs.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-17 15:02 UTC
CWE
- CWE-287 - Improper Authentication - Generic
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Rocket.Chat | Rocket.Chat |
Affected:
0 , < 8.5.1
(semver)
Affected: 0 , < 8.4.4 (semver) Affected: 0 , < 8.3.6 (semver) Affected: 0 , < 8.2.6 (semver) Affected: 0 , < 8.1.6 (semver) Affected: 0 , < 8.0.7 (semver) Affected: 0 , < 7.13.9 (semver) Affected: 0 , < 7.10.13 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-48929",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-17T15:02:38.629156Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-17T15:02:44.803Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Rocket.Chat",
"vendor": "Rocket.Chat",
"versions": [
{
"lessThan": "8.5.1",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.4.4",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.3.6",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.2.6",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.1.6",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.0.7",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "7.13.9",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "7.10.13",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Rocket.Chat in versions \u003c8.5.1, \u003c8.4.4, \u003c8.3.6, \u003c8.2.6, \u003c8.1.6, \u003c8.0.7, \u003c7.13.9, and \u003c7.10.13 is vulnerable to unauthenticated file deletion. The deleteFileMessage Meteor method permanently deletes any uploaded file by ID without requiring authentication. When called via an unauthenticated DDP WebSocket connection, Meteor.userId() returns null, causing the authorization check to be skipped. Execution falls through to FileUpload.getStore(\u0027Uploads\u0027).deleteById(fileID), which removes the file from storage and database unconditionally. File IDs are discoverable from public channel message payloads and download URLs."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper Authentication - Generic",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-16T23:08:37.888Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://hackerone.com/reports/3611837"
},
{
"url": "https://github.com/RocketChat/Rocket.Chat/pull/40889/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-48929",
"datePublished": "2026-06-16T23:08:37.888Z",
"dateReserved": "2026-05-26T15:00:06.427Z",
"dateUpdated": "2026-06-17T15:02:44.803Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-32995 (GCVE-0-2026-32995)
Vulnerability from cvelistv5 – Published: 2026-05-28 04:01 – Updated: 2026-05-28 13:13
VLAI
EPSS
VEX
Summary
The Rocket.Chat DDP method autoTranslate.translateMessage in versions <8.5.0, <8.4.2, <8.3.4, <8.2.4, <8.1.5, <8.0.5, <7.13.8, and <7.10.12 accepts a client-supplied IMessage object and passes it directly to translateMessage() without checking Meteor.userId() or verifying room membership. Any authenticated DDP user can read the content of any message by ID from any room (private channels, DMs, E2EE rooms) by calling this method.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-28 13:13 UTC
CWE
- CWE-284 - Improper Access Control - Generic
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Rocket.Chat | Rocket.Chat |
Affected:
8.5.0 , < 8.5.0
(semver)
Affected: 8.4.0 , < 8.4.2 (semver) Affected: 8.3.0 , < 8.3.4 (semver) Affected: 8.2.0 , < 8.2.4 (semver) Affected: 8.1.0 , < 8.1.5 (semver) Affected: 8.0.0 , < 8.0.6 (semver) Affected: 7.13.0 , < 7.13.8 (semver) Affected: 7.10.0 , < 7.10.12 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-32995",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-28T13:13:28.908184Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-28T13:13:36.583Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Rocket.Chat",
"vendor": "Rocket.Chat",
"versions": [
{
"lessThan": "8.5.0",
"status": "affected",
"version": "8.5.0",
"versionType": "semver"
},
{
"lessThan": "8.4.2",
"status": "affected",
"version": "8.4.0",
"versionType": "semver"
},
{
"lessThan": "8.3.4",
"status": "affected",
"version": "8.3.0",
"versionType": "semver"
},
{
"lessThan": "8.2.4",
"status": "affected",
"version": "8.2.0",
"versionType": "semver"
},
{
"lessThan": "8.1.5",
"status": "affected",
"version": "8.1.0",
"versionType": "semver"
},
{
"lessThan": "8.0.6",
"status": "affected",
"version": "8.0.0",
"versionType": "semver"
},
{
"lessThan": "7.13.8",
"status": "affected",
"version": "7.13.0",
"versionType": "semver"
},
{
"lessThan": "7.10.12",
"status": "affected",
"version": "7.10.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Rocket.Chat DDP method autoTranslate.translateMessage in versions \u003c8.5.0, \u003c8.4.2, \u003c8.3.4, \u003c8.2.4, \u003c8.1.5, \u003c8.0.5, \u003c7.13.8, and \u003c7.10.12 accepts a client-supplied IMessage object and passes it directly to translateMessage() without checking Meteor.userId() or verifying room membership. Any authenticated DDP user can read the content of any message by ID from any room (private channels, DMs, E2EE rooms) by calling this method."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control - Generic",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-28T04:01:37.645Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://hackerone.com/reports/3734326"
},
{
"url": "https://github.com/RocketChat/Rocket.Chat/pull/40528"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-32995",
"datePublished": "2026-05-28T04:01:37.645Z",
"dateReserved": "2026-03-17T15:00:07.746Z",
"dateUpdated": "2026-05-28T13:13:36.583Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-32994 (GCVE-0-2026-32994)
Vulnerability from cvelistv5 – Published: 2026-05-19 04:43 – Updated: 2026-05-19 12:36
VLAI
EPSS
VEX
Summary
The /api/v1/autotranslate.translateMessage endpoint in versions <8.5.0, <8.4.2, <8.3.4, <8.2.4, <8.1.5, <8.0.6, <7.13.8, and <7.10.12 allows any authenticated user to retrieve the full content of any message from any room (private groups, direct messages, channels) by simply providing the target message ID. The endpoint fetches the message via Messages.findOneById(messageId) with no room access check (canAccessRoomIdAsync is never called), returning the complete IMessage object including message text, sender info, room ID, timestamps, and markdown content.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-19 12:36 UTC
CWE
- CWE-284 - Improper Access Control - Generic
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Rocket.Chat | Rocket.Chat |
Affected:
0 , < 8.5.0
(semver)
Affected: 0 , < 8.4.2 (semver) Affected: 0 , < 8.3.4 (semver) Affected: 0 , < 8.2.4 (semver) Affected: 0 , < 8.1.5 (semver) Affected: 0 , < 8.0.6 (semver) Affected: 0 , < 7.13.8 (semver) Affected: 0 , < 7.10.12 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-32994",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-19T12:36:21.168251Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-19T12:36:27.839Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Rocket.Chat",
"vendor": "Rocket.Chat",
"versions": [
{
"lessThan": "8.5.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.4.2",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.3.4",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.2.4",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.1.5",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "8.0.6",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "7.13.8",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "7.10.12",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The /api/v1/autotranslate.translateMessage endpoint in versions \u003c8.5.0, \u003c8.4.2, \u003c8.3.4, \u003c8.2.4, \u003c8.1.5, \u003c8.0.6, \u003c7.13.8, and \u003c7.10.12 allows any authenticated user to retrieve the full content of any message from any room (private groups, direct messages, channels) by simply providing the target message ID. The endpoint fetches the message via Messages.findOneById(messageId) with no room access check (canAccessRoomIdAsync is never called), returning the complete IMessage object including message text, sender info, room ID, timestamps, and markdown content."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control - Generic",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-19T04:43:41.777Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://hackerone.com/reports/3713682"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-32994",
"datePublished": "2026-05-19T04:43:41.777Z",
"dateReserved": "2026-03-17T15:00:07.746Z",
"dateUpdated": "2026-05-19T12:36:27.839Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-29197 (GCVE-0-2026-29197)
Vulnerability from cvelistv5 – Published: 2026-04-23 23:19 – Updated: 2026-04-24 14:18
VLAI
EPSS
VEX
Summary
In versions <8.4.0, <8.3.2, <8.2.2, <8.1.3, <8.0.4, <7.13.6, <7.12.7, <7.11.7, and <7.10.10, the endpoints /api/apps/logs and /api/apps/:id/logs have a typo in the required permission check, allowing authenticated users without the proper permissions to read apps-engine logs.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-24 14:17 UTC
CWE
- CWE-284 - Improper Access Control - Generic
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Rocket.Chat | Rocket.Chat |
Affected:
8.4.0 , < 8.4.0
(semver)
Affected: 8.3.2 , < 8.3.2 (semver) Affected: 8.2.2 , < 8.2.2 (semver) Affected: 8.1.3 , < 8.1.3 (semver) Affected: 8.0.4 , < 8.0.4 (semver) Affected: 7.13.6 , < 7.13.6 (semver) Affected: 7.12.7 , < 7.12.7 (semver) Affected: 7.11.7 , < 7.11.7 (semver) Affected: 7.10.10 , < 7.10.10 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-29197",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-24T14:17:53.996452Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T14:18:07.117Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Rocket.Chat",
"vendor": "Rocket.Chat",
"versions": [
{
"lessThan": "8.4.0",
"status": "affected",
"version": "8.4.0",
"versionType": "semver"
},
{
"lessThan": "8.3.2",
"status": "affected",
"version": "8.3.2",
"versionType": "semver"
},
{
"lessThan": "8.2.2",
"status": "affected",
"version": "8.2.2",
"versionType": "semver"
},
{
"lessThan": "8.1.3",
"status": "affected",
"version": "8.1.3",
"versionType": "semver"
},
{
"lessThan": "8.0.4",
"status": "affected",
"version": "8.0.4",
"versionType": "semver"
},
{
"lessThan": "7.13.6",
"status": "affected",
"version": "7.13.6",
"versionType": "semver"
},
{
"lessThan": "7.12.7",
"status": "affected",
"version": "7.12.7",
"versionType": "semver"
},
{
"lessThan": "7.11.7",
"status": "affected",
"version": "7.11.7",
"versionType": "semver"
},
{
"lessThan": "7.10.10",
"status": "affected",
"version": "7.10.10",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In versions \u003c8.4.0, \u003c8.3.2, \u003c8.2.2, \u003c8.1.3, \u003c8.0.4, \u003c7.13.6, \u003c7.12.7, \u003c7.11.7, and \u003c7.10.10, the endpoints /api/apps/logs and /api/apps/:id/logs have a typo in the required permission check, allowing authenticated users without the proper permissions to read apps-engine logs."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control - Generic",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-23T23:19:40.722Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://hackerone.com/reports/3589551"
},
{
"url": "https://github.com/RocketChat/Rocket.Chat/pull/40125"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-29197",
"datePublished": "2026-04-23T23:19:40.722Z",
"dateReserved": "2026-03-04T15:00:09.266Z",
"dateUpdated": "2026-04-24T14:18:07.117Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-29198 (GCVE-0-2026-29198)
Vulnerability from cvelistv5 – Published: 2026-04-22 23:30 – Updated: 2026-04-23 17:41
VLAI
EPSS
VEX
Summary
In Rocket.Chat <8.3.0, <8.2.1, <8.1.2, <8.0.3, <7.13.5, <7.12.6, <7.11.6, and <7.10.9, a NoSQL injection vulnerability can lead to account takeover of the first user with a generated token when an OAuth app is configured.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-23 17:41 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Rocket.Chat | Rocket.Chat |
Unaffected:
8.3.0 , < 8.3.0
(semver)
Unaffected: 8.2.1 , < 8.2.1 (semver) Unaffected: 8.0.3 , < 8.0.3 (semver) Unaffected: 7.13.5 , < 7.13.5 (semver) Unaffected: 7.12.6 , < 7.12.6 (semver) Unaffected: 7.11.6 , < 7.11.6 (semver) Unaffected: 7.10.9 , < 7.10.9 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-29198",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-23T17:41:26.415612Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-23T17:41:50.981Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Rocket.Chat",
"vendor": "Rocket.Chat",
"versions": [
{
"lessThan": "8.3.0",
"status": "unaffected",
"version": "8.3.0",
"versionType": "semver"
},
{
"lessThan": "8.2.1",
"status": "unaffected",
"version": "8.2.1",
"versionType": "semver"
},
{
"lessThan": "8.0.3",
"status": "unaffected",
"version": "8.0.3",
"versionType": "semver"
},
{
"lessThan": "7.13.5",
"status": "unaffected",
"version": "7.13.5",
"versionType": "semver"
},
{
"lessThan": "7.12.6",
"status": "unaffected",
"version": "7.12.6",
"versionType": "semver"
},
{
"lessThan": "7.11.6",
"status": "unaffected",
"version": "7.11.6",
"versionType": "semver"
},
{
"lessThan": "7.10.9",
"status": "unaffected",
"version": "7.10.9",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In Rocket.Chat \u003c8.3.0, \u003c8.2.1, \u003c8.1.2, \u003c8.0.3, \u003c7.13.5, \u003c7.12.6, \u003c7.11.6, and \u003c7.10.9, a NoSQL injection vulnerability can lead to account takeover of the first user with a generated token when an OAuth app is configured."
}
],
"providerMetadata": {
"dateUpdated": "2026-04-22T23:30:15.355Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://hackerone.com/reports/3564655"
},
{
"url": "https://github.com/RocketChat/Rocket.Chat/pull/39492"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-29198",
"datePublished": "2026-04-22T23:30:15.355Z",
"dateReserved": "2026-03-04T15:00:09.266Z",
"dateUpdated": "2026-04-23T17:41:50.981Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-22560 (GCVE-0-2026-22560)
Vulnerability from cvelistv5 – Published: 2026-04-10 17:00 – Updated: 2026-04-14 19:04
VLAI
EPSS
VEX
Summary
An open redirect vulnerability in Rocket.Chat versions prior to 8.4.0 allows users to be redirected to arbitrary URLs by manipulating parameters within a SAML endpoint.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-14 19:04 UTC
CWE
- CWE-601 - Open Redirect
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Rocket.Chat | Rocket.Chat |
Affected:
8.4.0 , < 8.4.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-22560",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-14T19:04:29.881437Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-14T19:04:32.571Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Rocket.Chat",
"vendor": "Rocket.Chat",
"versions": [
{
"lessThan": "8.4.0",
"status": "affected",
"version": "8.4.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An open redirect vulnerability in Rocket.Chat versions prior to 8.4.0 allows users to be redirected to arbitrary URLs by manipulating parameters within a SAML endpoint."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601 Open Redirect",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-10T17:00:11.746Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://hackerone.com/reports/3418031"
},
{
"url": "https://github.com/RocketChat/Rocket.Chat/pull/38994"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-22560",
"datePublished": "2026-04-10T17:00:11.746Z",
"dateReserved": "2026-01-07T15:39:03.440Z",
"dateUpdated": "2026-04-14T19:04:32.571Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-30833 (GCVE-0-2026-30833)
Vulnerability from cvelistv5 – Published: 2026-03-06 17:40 – Updated: 2026-03-09 14:56
VLAI
EPSS
VEX
Title
Rocket.Chat: NoSQL injection in the EE ddp-streamer-service
Summary
Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to versions 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1, and 8.2.0, a NoSQL injection vulnerability exists in Rocket.Chat's account service used in the ddp-streamer micro service that allows unauthenticated attackers to manipulate MongoDB queries during authentication. The vulnerability is located in the username-based login flow where user-supplied input is directly embedded into a MongoDB query selector without validation. An attacker can inject MongoDB operator expressions (e.g., { $regex: '.*' }) in place of a username string, causing the database query to match unintended user records. This issue has been patched in versions 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1, and 8.2.0.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-09 14:55 UTC
CWE
- CWE-943 - Improper Neutralization of Special Elements in Data Query Logic
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/RocketChat/Rocket.Chat/securit… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| RocketChat | Rocket.Chat |
Affected:
< 7.10.8
Affected: < 7.11.5 Affected: < 7.12.5 Affected: < 7.13.4 Affected: < 8.0.2 Affected: < 8.1.1 Affected: < 8.2.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-30833",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-09T14:55:56.507627Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-09T14:56:03.564Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Rocket.Chat",
"vendor": "RocketChat",
"versions": [
{
"status": "affected",
"version": "\u003c 7.10.8"
},
{
"status": "affected",
"version": "\u003c 7.11.5"
},
{
"status": "affected",
"version": "\u003c 7.12.5"
},
{
"status": "affected",
"version": "\u003c 7.13.4"
},
{
"status": "affected",
"version": "\u003c 8.0.2"
},
{
"status": "affected",
"version": "\u003c 8.1.1"
},
{
"status": "affected",
"version": "\u003c 8.2.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to versions 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1, and 8.2.0, a NoSQL injection vulnerability exists in Rocket.Chat\u0027s account service used in the ddp-streamer micro service that allows unauthenticated attackers to manipulate MongoDB queries during authentication. The vulnerability is located in the username-based login flow where user-supplied input is directly embedded into a MongoDB query selector without validation. An attacker can inject MongoDB operator expressions (e.g., { $regex: \u0027.*\u0027 }) in place of a username string, causing the database query to match unintended user records. This issue has been patched in versions 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1, and 8.2.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-943",
"description": "CWE-943: Improper Neutralization of Special Elements in Data Query Logic",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-06T17:40:36.939Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-hgq6-9jg2-wf3f",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-hgq6-9jg2-wf3f"
}
],
"source": {
"advisory": "GHSA-hgq6-9jg2-wf3f",
"discovery": "UNKNOWN"
},
"title": "Rocket.Chat: NoSQL injection in the EE ddp-streamer-service"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-30833",
"datePublished": "2026-03-06T17:40:36.939Z",
"dateReserved": "2026-03-05T21:06:44.606Z",
"dateUpdated": "2026-03-09T14:56:03.564Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-30831 (GCVE-0-2026-30831)
Vulnerability from cvelistv5 – Published: 2026-03-06 17:40 – Updated: 2026-03-11 03:56
VLAI
EPSS
VEX
Title
Rocket.Chat: 2FA bypass and login of deactivated users via EE ddp-streamer
Summary
Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to versions 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1, and 8.2.0, authentication vulnerabilities exist in Rocket.Chat's enterprise DDP Streamer service. The Account.login method exposed through the DDP Streamer does not enforce Two-Factor Authentication (2FA) or validate user account status (deactivated users can still login), despite these checks being mandatory in the standard Meteor login flow. This issue has been patched in versions 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1, and 8.2.0.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-10 00:00 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/RocketChat/Rocket.Chat/securit… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| RocketChat | Rocket.Chat |
Affected:
< 7.10.8
Affected: < 7.11.5 Affected: < 7.12.5 Affected: < 7.13.4 Affected: < 8.0.2 Affected: < 8.1.1 Affected: < 8.2.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-30831",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-10T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-11T03:56:34.815Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Rocket.Chat",
"vendor": "RocketChat",
"versions": [
{
"status": "affected",
"version": "\u003c 7.10.8"
},
{
"status": "affected",
"version": "\u003c 7.11.5"
},
{
"status": "affected",
"version": "\u003c 7.12.5"
},
{
"status": "affected",
"version": "\u003c 7.13.4"
},
{
"status": "affected",
"version": "\u003c 8.0.2"
},
{
"status": "affected",
"version": "\u003c 8.1.1"
},
{
"status": "affected",
"version": "\u003c 8.2.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to versions 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1, and 8.2.0, authentication vulnerabilities exist in Rocket.Chat\u0027s enterprise DDP Streamer service. The Account.login method exposed through the DDP Streamer does not enforce Two-Factor Authentication (2FA) or validate user account status (deactivated users can still login), despite these checks being mandatory in the standard Meteor login flow. This issue has been patched in versions 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1, and 8.2.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287: Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-304",
"description": "CWE-304: Missing Critical Step in Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-06T17:40:27.824Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-7qr6-q62g-hm63",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-7qr6-q62g-hm63"
}
],
"source": {
"advisory": "GHSA-7qr6-q62g-hm63",
"discovery": "UNKNOWN"
},
"title": "Rocket.Chat: 2FA bypass and login of deactivated users via EE ddp-streamer"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-30831",
"datePublished": "2026-03-06T17:40:27.824Z",
"dateReserved": "2026-03-05T21:06:44.606Z",
"dateUpdated": "2026-03-11T03:56:34.815Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-28514 (GCVE-0-2026-28514)
Vulnerability from cvelistv5 – Published: 2026-03-06 17:35 – Updated: 2026-03-11 03:56
VLAI
EPSS
VEX
Title
Rocket.Chat: Users can login with any password via the EE ddp-streamer-service
Summary
Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to versions 7.8.6, 7.9.8, 7.10.7, 7.11.4, 7.12.4, 7.13.3, and 8.0.0, a critical authentication bypass vulnerability exists in Rocket.Chat's account service used in the ddp-streamer micro service that allows an attacker to log in to the service as any user with a password set, using any arbitrary password. The vulnerability stems from a missing await keyword when calling an asynchronous password validation function, causing a Promise object (which is always truthy) to be evaluated instead of the actual boolean validation result. This may lead to account takeover of any user whose username is known or guessable. This issue has been patched in versions 7.8.6, 7.9.8, 7.10.7, 7.11.4, 7.12.4, 7.13.3, and 8.0.0.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-10 00:00 UTC
CWE
- CWE-287 - Improper Authentication
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/RocketChat/Rocket.Chat/securit… | x_refsource_CONFIRM |
| https://github.com/RocketChat/Rocket.Chat/pull/37143 | x_refsource_MISC |
| https://github.com/RocketChat/Rocket.Chat/commit/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| RocketChat | Rocket.Chat |
Affected:
< 7.8.6
Affected: < 7.9.8 Affected: < 7.10.7 Affected: < 7.11.4 Affected: < 7.12.4 Affected: < 7.13.3 Affected: < 8.0.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-28514",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-10T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-11T03:56:35.920Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Rocket.Chat",
"vendor": "RocketChat",
"versions": [
{
"status": "affected",
"version": "\u003c 7.8.6"
},
{
"status": "affected",
"version": "\u003c 7.9.8"
},
{
"status": "affected",
"version": "\u003c 7.10.7"
},
{
"status": "affected",
"version": "\u003c 7.11.4"
},
{
"status": "affected",
"version": "\u003c 7.12.4"
},
{
"status": "affected",
"version": "\u003c 7.13.3"
},
{
"status": "affected",
"version": "\u003c 8.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to versions 7.8.6, 7.9.8, 7.10.7, 7.11.4, 7.12.4, 7.13.3, and 8.0.0, a critical authentication bypass vulnerability exists in Rocket.Chat\u0027s account service used in the ddp-streamer micro service that allows an attacker to log in to the service as any user with a password set, using any arbitrary password. The vulnerability stems from a missing await keyword when calling an asynchronous password validation function, causing a Promise object (which is always truthy) to be evaluated instead of the actual boolean validation result. This may lead to account takeover of any user whose username is known or guessable. This issue has been patched in versions 7.8.6, 7.9.8, 7.10.7, 7.11.4, 7.12.4, 7.13.3, and 8.0.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287: Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-06T17:35:01.841Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-w6vw-mrgv-69vf",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-w6vw-mrgv-69vf"
},
{
"name": "https://github.com/RocketChat/Rocket.Chat/pull/37143",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/RocketChat/Rocket.Chat/pull/37143"
},
{
"name": "https://github.com/RocketChat/Rocket.Chat/commit/7d89aae0b1bd08e82b02ceab4c180b430e2c6f07",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/RocketChat/Rocket.Chat/commit/7d89aae0b1bd08e82b02ceab4c180b430e2c6f07"
}
],
"source": {
"advisory": "GHSA-w6vw-mrgv-69vf",
"discovery": "UNKNOWN"
},
"title": "Rocket.Chat: Users can login with any password via the EE ddp-streamer-service"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-28514",
"datePublished": "2026-03-06T17:35:01.841Z",
"dateReserved": "2026-02-27T20:57:47.710Z",
"dateUpdated": "2026-03-11T03:56:35.920Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23477 (GCVE-0-2026-23477)
Vulnerability from cvelistv5 – Published: 2026-01-14 18:16 – Updated: 2026-01-14 21:14
VLAI
EPSS
VEX
Title
Rocket.Chat Unauthorized Access to OAuth App Details
Summary
Rocket.Chat is an open-source, secure, fully customizable communications platform. In Rocket.Chat versions up to 6.12.0, the API endpoint GET /api/v1/oauth-apps.get is exposed to any authenticated user, regardless of their role or permissions. This endpoint returns an OAuth application, as long as the user knows its ID, including potentially sensitive fields such as client_id and client_secret. This vulnerability is fixed in 6.12.0.
Severity
7.7 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-14 21:13 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/RocketChat/Rocket.Chat/securit… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| RocketChat | Rocket.Chat |
Affected:
< 6.12.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-23477",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-14T21:13:59.771321Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-14T21:14:08.081Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Rocket.Chat",
"vendor": "RocketChat",
"versions": [
{
"status": "affected",
"version": "\u003c 6.12.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Rocket.Chat is an open-source, secure, fully customizable communications platform. In Rocket.Chat versions up to 6.12.0, the API endpoint GET /api/v1/oauth-apps.get is exposed to any authenticated user, regardless of their role or permissions. This endpoint returns an OAuth application, as long as the user knows its ID, including potentially sensitive fields such as client_id and client_secret. This vulnerability is fixed in 6.12.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269: Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-14T18:16:05.178Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-g4wm-fg3c-g4p2",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-g4wm-fg3c-g4p2"
}
],
"source": {
"advisory": "GHSA-g4wm-fg3c-g4p2",
"discovery": "UNKNOWN"
},
"title": "Rocket.Chat Unauthorized Access to OAuth App Details"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-23477",
"datePublished": "2026-01-14T18:16:05.178Z",
"dateReserved": "2026-01-13T15:47:41.627Z",
"dateUpdated": "2026-01-14T21:14:08.081Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}