CVE-2026-65645Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6.
Updated under an hour ago ()
Does this affect you?
It affects Rocket.Chat. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6. 8.3.8, 8.2.8, 8.1.8, and 7.10.15, the Meteor DDP methods getThreadsList and getThreadMessages accept rid / tmid as raw, untyped parameters with no schema validation. A MongoDB operator object (e.g. {"$gt": "4"}) can be substituted for a string room-id or message-id. The authorization check resolves to a room the attacker already has access to, while the downstream data query fans out across all rooms - disclosing private thread parents and their full reply content to any low-privilege authenticated user. The REST route chat.getThreadsList was patched in v5.0 (HackerOne report #1446767) by adding rid: {type:'string'} AJV validation. The equivalent DDP method was never given the same fix and remains exploitable
- CVSS
- 4.3 MEDIUM (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness (CWE)
- CWE-20
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- hackerone
- NVD analysis
- Analyzed
- Record last updated
- Aug 27, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Rocket.Chat Rocket.Chat rocket.chat:rocket.chat (from the name) | before 8.8.0; before 8.7.1; before 8.6.2; before 8.5.3; before 8.4.6; before 8.3.8; before 8.2.8; before 8.1.8; and 1 more ranges | CNA record |
rocket.chat rocket.chat rocket.chat:rocket.chat | before 7.10.15; from 8.1.0 before 8.1.8; from 8.2.0 before 8.2.8; from 8.3.0 before 8.3.8; from 8.4.0 before 8.4.6; from 8.5.0 before 8.5.3; from 8.6.0 before 8.6.2; 8.7.0 | NVD |
References
- https://hackerone.com/reports/3852135third-party-advisory, issue-tracking
- https://github.com/RocketChat/Rocket.Chat/pull/41814patch, vendor-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.