Rocketchat Rocket.chat vulnerabilities

• rocket.chat Rocket.Chat Missing DDP Rate Limit on the sendForgotPasswordEmail Meteor Method CVE-2026-75575 6.9 MediumAugust 25, 2026
• rocket.chat Rocket.Chat: Broken Access Control in channels.convertToTeam Allows Unauthorized Conversion of Public Channels into Teams CVE-2026-72919 4.3 MediumAugust 10, 2026
• rocket.chat Rocket.Chat: Insecure implementation of websocket notifications CVE-2026-72918 5.4 MediumAugust 10, 2026
• rocket.chat Rocket.Chat: Any Authenticated User Can Permanently Deregister Workspace from Rocket.Chat Cloud via Unprotected `/api/v1/fingerprint` Endpoint CVE-2026-55762 8.1 HighJune 24, 2026
• rocket.chat Rocket.Chat: Apple Sign-In skips JWT claims validation, allowing expired and cross-audience token replay CVE-2026-55759 7.4 HighJune 24, 2026
• rocket.chat Rocket.Chat: Email Parameter Fallback Leads To Account Takeover Within Apple OAuth CVE-2026-55666 9.3 CriticalJune 24, 2026
• rocket.chat Rocket.Chat: Livechat Visitor Profile Disclosure Leaks Bearer Token and Enables Visitor Impersonation CVE-2026-49278 6.7 MediumJune 24, 2026
• rocket.chat Rocket.Chat: OAuth access and refresh tokens remain valid after account deactivation CVE-2026-49277 2.3 LowJune 24, 2026
• rocket.chat Rocket.Chat: users.deactivateIdle` deactivates accounts without revoking existing login tokens CVE-2026-45757 2.3 LowJune 24, 2026
• rocket.chat Rocket.Chat: SAML signature validation skipped when IdP certificate field is empty CVE-2026-46423 9.3 CriticalJune 24, 2026
• rocket.chat Rocket.Chat: Pre-Auth NoSQL Injection in OAuth2 Token Endpoint leading to Arbitrary User ATO CVE-2026-45689 9.1 CriticalJune 24, 2026
• rocket.chat Rocket.Chat: Pre-Auth NoSQL Injection in CAS Login Handler leading to Arbitrary CAS/SAML User Session Hijack CVE-2026-45688 9.1 CriticalJune 24, 2026
• rocket.chat Rocket.Chat: Authenticated Arbitrary Data Export Theft via Mass Assignment in sendFileMessage CVE-2026-45687 8.5 HighJune 24, 2026
• rocket.chat Rocket.Chat: Lack of SAML Signature Check During Logout Could Lead To DoS CVE-2026-45677 8.7 HighJune 24, 2026
• rocket.chat Rocket.Chat: Missing URL protocol sanitization in ImageElement allows javascript: URLs in markdown images CVE-2026-47733 4.4 MediumJune 24, 2026
• rocket.chat Rocket.Chat: NoSQL injection in the EE ddp-streamer-service CVE-2026-30833 6.9 MediumMarch 6, 2026
• rocket.chat Rocket.Chat: 2FA bypass and login of deactivated users via EE ddp-streamer CVE-2026-30831 8.0 HighMarch 6, 2026
• rocket.chat Rocket.Chat: Users can login with any password via the EE ddp-streamer-service CVE-2026-28514 9.3 CriticalMarch 6, 2026
• rocket.chat Rocket.Chat Unauthorized Access to OAuth App Details CVE-2026-23477 7.7 HighJanuary 14, 2026
• notfound mobile, rocketchat rocket.chat +1 more The E2EE password entropy generated by Rocket.Chat Mobile prior to version 4.5.1 is insufficient,... CVE-2024-42027 6.7 MediumOctober 7, 2024
• rocketchat rocket.chat Rocket.Chat 6.12.0, 6.11.2, 6.10.5, 6.9.6, 6.8.6, 6.7.8, and before is vulnerable to a message... CVE-2024-46936 7.5 HighSeptember 24, 2024
• rocket.chat ReDOS in Rocket.Chat CVE-2021-32832 4.3 MediumAugust 30, 2021
• rocketchat rocket.chat Rocket.Chat version 0.8.0 and newer is vulnerable to XSS in the markdown link parsing code for... CVE-2017-1000054 6.1 MediumJuly 13, 2017