Read the docs
TI-2026-25443 Aliases CVE-2026-32995GHSA-2v6f-4wc2-p3hq

Improper access control in Rocket.Chat

Priority LOW 39CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA. Impact type from CWE-284.

Summary

The Rocket.Chat DDP method autoTranslate.translateMessage in versions <8.5.0, <8.4.2, <8.3.4, <8.2.4, <8.1.5, <8.0.5, <7.13.8, and <7.10.12 accepts a client-supplied IMessage object and passes it directly to translateMessage() without checking Meteor.userId() or verifying room membership. Any authenticated DDP user can read the content of any message by ID from any room (private channels, DMs, E2EE rooms) by calling this method.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00283 20th percentileScored 2026-11-07
Fix Fixed Rocket.Chat (Rocket.Chat): 8.5.0, 8.4.2, 8.3.4 +5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Rocket.ChatRocket.Chat8.5.0 to before 8.5.0; 8.4.0 to before 8.4.2; 8.3.0 to before 8.3.4; 8.2.0 to before 8.2.4; 8.1.0 to before 8.1.5; 8.0.0 to before 8.0.6; 7.13.0 to before 7.13.8; 7.10.0 to before 7.10.128.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, 7.10.12Patch availableCNA
  • Rocket.Chat VendorRocket.Chat Affected 8.5.0 to before 8.5.0; 8.4.0 to before 8.4.2; 8.3.0 to before 8.3.4; 8.2.0 to before 8.2.4; 8.1.0 to before 8.1.5; 8.0.0 to before 8.0.6; 7.13.0 to before 7.13.8; 7.10.0 to before 7.10.12 Fixed in 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, 7.10.12 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:*——Rocket.Chat
  • cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:* Versions — — ·Rocket.Chat

Remediation

  • Fix · CNA Rocket.Chat (Rocket.Chat) Fixed in 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, 7.10.12

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-32995
  2. 2026-10-03 Alias added: GHSA-2v6f-4wc2-p3hq

References

Other 2

  • TI-2021-05772 A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 &… CVSS 3.1CRITICAL 9.8
  • TI-2022-13921 SQL injection in Rocket.Chat CVSS 3.1HIGH 8.8
  • TI-2026-18910 Rocket.Chat Unauthorized Access to OAuth App Details CVSS 3.1HIGH 7.7
  • TI-2022-12398 Improper authentication in Rocket.Chat Mobile app CVSS 3.1MEDIUM 6.8
  • TI-2024-24909 Code injection in Rocket.Chat CVSS 3.0MEDIUM 6.5
  • TI-2022-13929 Information disclosure in Rocket.Chat CVSS 3.1MEDIUM 6.5
See all 68 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences