Skip to content
OpenAdvisories

Vendor

RocketChat

36 known vulnerabilities.

Products

Rocket.Chat 34 Rocket.Chat Desktop 1 Mobile 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Low 2.3
    CVE-2026-49277

    Rocket.Chat: OAuth access and refresh tokens remain valid after account deactivation

    Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12, Rocket.Chat does not revoke OAuth bearer or refresh tokens when a user is deactivated. A deactivated use…

    RocketChat Rocket.Chat
  • Low 2.3
    CVE-2026-45757

    Rocket.Chat: users.deactivateIdle` deactivates accounts without revoking existing login tokens

    Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12, Rocket.Chat allows users deactivated through users.deactivateIdle to keep using already-issued login tok…

    RocketChat Rocket.Chat
  • Low 3.7
    CVE-2025-7974

    rocket.chat Incorrect Authorization Information Disclosure Vulnerability

    rocket.chat Incorrect Authorization Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of rocket.chat. Authentication is not required to exploit this vulnerability. The …

    RocketChat Rocket.Chat