RocketChat

Records21All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical5CVSS 9.0–10.0

CVSS high6CVSS 7.0–8.9

Exploited now

RocketChat records in CISA KEV

No RocketChat vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Rocket.chat 1 record LOW

Records

21 records

TI-2026-33430 CVE-2026-45688

Rocket.Chat: Pre-Auth NoSQL Injection in CAS Login Handler leading to Arbitrary CAS/SAML User Session Hijack

HIGH 80

Rocket.Chat is an open-source, secure, fully customizable communications platform.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00493 Published 2026-06-24 Fixed in 8.5.0, 8.4.1 +6 CWE-943

TI-2026-33431 CVE-2026-45689

Rocket.Chat: Pre-Auth NoSQL Injection in OAuth2 Token Endpoint leading to Arbitrary User ATO

HIGH 74

Rocket.Chat is an open-source, secure, fully customizable communications platform.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00526 Published 2026-06-24 Fixed in 8.5.0, 8.4.1 +6 CWE-943

TI-2026-18910 CVE-2026-23477

Rocket.Chat Unauthorized Access to OAuth App Details

HIGH 67

Rocket.Chat is an open-source, secure, fully customizable communications platform.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00356 Published 2026-01-14 Fixed in 6.12.0 CWE-269

TI-2026-35234 CVE-2026-47733

Rocket.Chat: Missing URL protocol sanitization in ImageElement allows javascript: URLs in markdown images

MEDIUM 54

Rocket.Chat is an open-source, secure, fully customizable communications platform.

CVSS 3.1MEDIUM 4.4 Network Low privileges User interaction EPSS 0.00141 Published 2026-06-24 Fixed in 8.5.0 CWE-79

TI-2026-22776 CVE-2026-28514

Rocket.Chat: Users can login with any password via the EE ddp-streamer-service

MEDIUM 49

Rocket.Chat is an open-source, secure, fully customizable communications platform.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00553 Published 2026-03-06 Fixed in 7.8.6, 7.9.8 +5 CWE-287

TI-2026-40188 CVE-2026-55666

Rocket.Chat: Email Parameter Fallback Leads To Account Takeover Within Apple OAuth

MEDIUM 48

Rocket.Chat is an open-source, secure, fully customizable communications platform.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00406 Published 2026-06-24 Fixed in 8.5.1, 8.4.4 +5 CWE-287

TI-2026-34135 CVE-2026-46423

Rocket.Chat: SAML signature validation skipped when IdP certificate field is empty

MEDIUM 47

Rocket.Chat is an open-source, secure, fully customizable communications platform.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00221 Published 2026-06-24 Fixed in 8.5.0, 8.4.1 +6 CWE-347

TI-2026-33494 CVE-2026-45757

Rocket.Chat: users.deactivateIdle` deactivates accounts without revoking existing login tokens

MEDIUM 45

Rocket.Chat is an open-source, secure, fully customizable communications platform.

CVSS 4.0LOW 2.3 Network No auth User interaction EPSS 0.0027 Published 2026-06-24 Fixed in 8.5.0, 8.4.2 +6 CWE-613

TI-2026-33419 CVE-2026-45677

Rocket.Chat: Lack of SAML Signature Check During Logout Could Lead To DoS

MEDIUM 45

Rocket.Chat is an open-source, secure, fully customizable communications platform.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00683 Published 2026-06-24 Fixed in 8.5.0, 8.4.1 +6 CWE-862

TI-2026-23660 CVE-2026-30831

Rocket.Chat: 2FA bypass and login of deactivated users via EE ddp-streamer

MEDIUM 43

Rocket.Chat is an open-source, secure, fully customizable communications platform.

CVSS 4.0HIGH 8.0 Network No auth No interaction EPSS 0.00379 Published 2026-03-06 Fixed in 7.10.8, 7.11.5 +5 CWE-287

TI-2026-40251 CVE-2026-55762

Missing authorization in RocketChat Rocket.Chat

LOW 38

Rocket.Chat is an open-source, secure, fully customizable communications platform.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00474 Published 2026-06-24 Fixed in 8.5.1, 8.4.4 +5 CWE-862

TI-2026-52895 CVE-2026-75575 · GHSA-jfh6-w7r2-rj74

Rocket.Chat Missing DDP Rate Limit on the sendForgotPasswordEmail Meteor Method

LOW 37

Rocket.Chat exposes the sendForgotPasswordEmail Meteor method without a DDP rate limit, so an unauthenticated caller may invoke it as often as it likes.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00397 Published 2026-08-25 Fixed in 7.10.15, 8.1.8 +7 CWE-204

TI-2026-33429 CVE-2026-45687

Rocket.Chat: Authenticated Arbitrary Data Export Theft via Mass Assignment in sendFileMessage

LOW 37

Rocket.Chat is an open-source, secure, fully customizable communications platform.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00341 Published 2026-06-24 Fixed in 8.5.0, 8.4.1 +6 CWE-915

TI-2026-23662 CVE-2026-30833

Rocket.Chat: NoSQL injection in the EE ddp-streamer-service

LOW 36

Rocket.Chat is an open-source, secure, fully customizable communications platform.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00302 Published 2026-03-06 Fixed in 7.10.8, 7.11.5 +5 CWE-943

TI-2026-40248 CVE-2026-55759

Rocket.Chat: Apple Sign-In skips JWT claims validation, allowing expired and cross-audience token replay

LOW 34

Rocket.Chat is an open-source, secure, fully customizable communications platform.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00323 Published 2026-06-24 Fixed in 8.5.1, 8.4.4 +5 CWE-287

TI-2026-36467 CVE-2026-49278

Rocket.Chat: Livechat Visitor Profile Disclosure Leaks Bearer Token and Enables Visitor Impersonation

LOW 32

Rocket.Chat is an open-source, secure, fully customizable communications platform.

CVSS 3.1MEDIUM 6.7 Network High privileges No interaction EPSS 0.00414 Published 2026-06-24 Fixed in 8.5.0, 8.4.2 +6 CWE-285

TI-2021-12497 CVE-2021-32832 · GHSA-wpp8-mvvg-33rx

ReDOS in Rocket.Chat

LOW 32

Rocket.Chat is an open-source fully customizable communications platform developed in JavaScript.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0162 Published 2021-08-30 Fixed in 3.11.3 CWE-400

TI-2017-14395 CVE-2017-1000054 · GHSA-82mg-vfjx-xjvw

Rocket.Chat version 0.8.0 and newer is vulnerable to XSS in the markdown link parsing code for messages.

LOW 28

Rocket.Chat version 0.8.0 and newer is vulnerable to XSS in the markdown link parsing code for messages.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00726 Published 2017-07-13 No fix listed CWE-79

TI-2026-51134 CVE-2026-72918

Rocket.Chat: Insecure implementation of websocket notifications

LOW 24

Rocket.Chat is an open-source, secure, fully customizable communications platform.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00225 Published 2026-08-10 Fixed in 7.10.14, 8.0.8 +6 CWE-862

TI-2026-51135 CVE-2026-72919

Missing authorization in RocketChat Rocket.Chat

LOW 20

Rocket.Chat is an open-source, secure, fully customizable communications platform.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00325 Published 2026-08-10 Fixed in 7.10.14, 8.0.8 +6 CWE-862

TI-2026-36466 CVE-2026-49277

Rocket.Chat: OAuth access and refresh tokens remain valid after account deactivation

LOW 12

Rocket.Chat is an open-source, secure, fully customizable communications platform.

CVSS 4.0LOW 2.3 Network No auth User interaction EPSS 0.00314 Published 2026-06-24 Fixed in 8.5.0, 8.4.2 +6 CWE-613

Open these records in search →

Critical	5
High	6
Medium	8
Low	2
No CVSS	0