RocketChat

11 results · Clear filters · Feed

• High 7.5
  CVE-2026-65644

  Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, and 7.10.15 has a REST API endpo…

  RocketChat Rocket.Chat
  Aug 21, 2026
• High 7.5
  CVE-2026-56845

  An unauthenticated path traversal (LFI) vulnerability exists under /custom-sounds/ when CustomSounds storage is configu…

  RocketChat Rocket.Chat
  Aug 4, 2026
• High 8.1
  CVE-2026-55762

  Rocket.Chat: Any Authenticated User Can Permanently Deregister Workspace from Rocket.Chat Cloud via Unprotected `/api/v1/fingerprint` Endpoint

  Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13, the POST /api/v1/fingerprint REST endpoint enforces authentication (authRequired: true) but performs no authoriz…

  RocketChat Rocket.Chat
  Jun 24, 2026
• High 7.4
  CVE-2026-55759

  Rocket.Chat: Apple Sign-In skips JWT claims validation, allowing expired and cross-audience token replay

  Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13, Rocket.Chat's Apple Sign-In handler verifies JWT signatures but skips claims validation. Any Apple-signed JWT wi…

  RocketChat Rocket.Chat
  Jun 24, 2026
• High 8.5
  CVE-2026-45687

  Rocket.Chat: Authenticated Arbitrary Data Export Theft via Mass Assignment in sendFileMessage

  Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11, Rocket.Chat's sendFileMessage DDP method passes the entire attacker-supplied file object into Uploads.up…

  RocketChat Rocket.Chat
  Jun 24, 2026
• High 8.7
  CVE-2026-45677

  Rocket.Chat: Lack of SAML Signature Check During Logout Could Lead To DoS

  Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11, Rocket.Chat's SAML integration does not verify the signature on inbound LogoutRequest messages. An unaut…

  RocketChat Rocket.Chat
  Jun 24, 2026
• High 7.5
  CVE-2026-48929

  Rocket.Chat in versions <8.5.1, <8.4.4, <8.3.6, <8.2.6, <8.1.6, <8.0.7, <7.13.9, and <7.10.13 is vulnerable to unauthen…

  RocketChat Rocket.Chat
  Jun 16, 2026
• High 7.5
  CVE-2026-32995

  The Rocket.Chat DDP method autoTranslate.translateMessage in versions <8.5.0, <8.4.2, <8.3.4, <8.2.4, <8.1.5, <8.0.5, <…

  RocketChat Rocket.Chat
  May 28, 2026
• High 8.0
  CVE-2026-30831

  Rocket.Chat: 2FA bypass and login of deactivated users via EE ddp-streamer

  Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to versions 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1, and 8.2.0, authentication vulnerabilities exist in Rocket.Chat's enterprise DDP Streamer service. The Account.lo…

  RocketChat Rocket.Chat
  Mar 6, 2026
• High 7.7
  CVE-2026-23477

  Rocket.Chat Unauthorized Access to OAuth App Details

  Rocket.Chat is an open-source, secure, fully customizable communications platform. In Rocket.Chat versions up to 6.12.0, the API endpoint GET /api/v1/oauth-apps.get is exposed to any authenticated user, regardless of their role or permissions. This endpoint r…

  RocketChat Rocket.Chat
  Jan 14, 2026
• High 8.6
  CVE-2024-39713 Public exploit Scanner template

  Rocket.Chat Server-Side Request Forgery (SSRF) vulnerability

  A Server-Side Request Forgery (SSRF) affects Rocket.Chat's Twilio webhook endpoint before version 6.10.1.

  RocketChat Rocket.Chat rocket.chat npm
  Aug 5, 2024