Read the docs
TI-2024-07666 Aliases CVE-2024-8270GHSA-g594-fq98-w6pj

macOS Rocket.Chat: TCC Policy Bypass via Dylib Injection Due to Missing Code Signing Flags and Dangerous Entitlements

Priority LOW 24CWE-863Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

The macOS Rocket.Chat application is affected by a vulnerability that allows bypassing Transparency, Consent, and Control (TCC) policies, enabling the exploitation or abuse of permissions specified in its entitlements (e.g., microphone, camera, automation, network client). Since Rocket.Chat was not signed with the Hardened Runtime nor set to enforce Library Validation, it is vulnerable to DYLIB injection attacks, which can lead to unauthorized actions or escalation of permissions. Consequently, an attacker gains capabilities that are not permitted by default under the Sandbox and its application profile.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00216 12th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Rocket.ChatRocket.Chat Desktopup to 4.1.2—No fix listedCNA
  • Rocket.Chat Desktop VendorRocket.Chat Affected up to 4.1.2 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-8270
  2. 2026-10-03 Alias added: GHSA-g594-fq98-w6pj

References

Other 2

  • TI-2021-05772 A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 &… CVSS 3.1CRITICAL 9.8
  • TI-2022-13921 SQL injection in Rocket.Chat CVSS 3.1HIGH 8.8
  • TI-2026-18910 Rocket.Chat Unauthorized Access to OAuth App Details CVSS 3.1HIGH 7.7
  • TI-2022-12398 Improper authentication in Rocket.Chat Mobile app CVSS 3.1MEDIUM 6.8
  • TI-2024-24909 Code injection in Rocket.Chat CVSS 3.0MEDIUM 6.5
  • TI-2022-13929 Information disclosure in Rocket.Chat CVSS 3.1MEDIUM 6.5
See all 68 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences