CVE-2026-75575Rocket.Chat Missing DDP Rate Limit on the sendForgotPasswordEmail Meteor Method
Updated under an hour ago ()
Does this affect you?
It affects RocketChat Rocket.Chat. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
Rocket.Chat exposes the sendForgotPasswordEmail Meteor method without a DDP rate limit, so an unauthenticated caller may invoke it as often as it likes. The method is reachable over DDP and over the HTTP route POST /api/v1/method.callAnon/sendForgotPasswordEmail, and it triggers a password reset message for any address that matches an account. With no DDPRateLimiter rule registered for it, a caller can drive an unbounded volume of reset mail at a chosen address from the deployment's own mail sender, and can probe addresses at scale: the method answers true for an address with no account and for a successful send, but false when the address belongs to an account that authenticates through an external provider and Accounts_AllowPasswordChangeForOAuthUsers is off, so repeated calls distinguish that class of account. Later versions register a rule permitting ten calls per minute per client address.
- CVSS
- 5.3 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness (CWE)
- CWE-307, CWE-204
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- VulnCheck
- NVD analysis
- Awaiting Analysis
- Record last updated
- Aug 29, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
RocketChat Rocket.Chat rocketchat:rocket.chat (from the name) | before 7.10.15; from 8.0.0 before 8.1.8; from 8.2.0 before 8.2.8; from 8.3.0 before 8.3.8; from 8.4.0 before 8.4.6; from 8.5.0 before 8.5.3; from 8.6.0 before 8.6.2; from 8.7.0 before 8.7.2; and 1 more ranges | CNA record |
References
- https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-7c6v-m68v-v73rvendor-advisory
- https://github.com/RocketChat/Rocket.Chatproduct
- https://github.com/RocketChat/Rocket.Chat/commit/3a61c3afepatch
- https://www.vulncheck.com/advisories/rocket-chat-missing-ddp-rate-limit-on-the-sendforgotpasswordemail-meteor-methodthird-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.