SB2026051449 - Multiple vulnerabilities in Rocket.Chat

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026051449

SB2026051449 - Multiple vulnerabilities in Rocket.Chat

Published: May 14, 2026 Updated: November 9, 2026

Security Bulletin ID SB2026051449
CSH Severity
High
Patch available
YES
Number of vulnerabilities 7
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 43% Medium 29% Low 29%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 7 vulnerabilities.


1) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2026-46423)

CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass authentication and impersonate arbitrary users.

The vulnerability exists due to improper verification of cryptographic signature in the SAML signature verification routine when processing SAML responses with an empty configured IdP certificate field. A remote attacker can submit a crafted unsigned or attacker-supplied SAML assertion to bypass authentication and impersonate arbitrary users.

The issue is reachable when SAML is enabled and the IdP certificate field is left at its default empty value.


2) Improperly Controlled Modification of Dynamically-Determined Object Attributes (CVE-ID: CVE-2026-45687)

CWE-ID: CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improperly controlled modification of dynamically-determined object attributes in the sendFileMessage DDP method and upload record handling when processing an attacker-supplied file object. A remote user can modify writable fields such as the storage backend and path on their own upload record to disclose sensitive information.

Exploitation requires an authenticated non-admin account and a cloud-backed upload backend such as Google Cloud Storage or Amazon S3. The victim must have previously generated a data export, and the export path is deterministic from the instance identifier and the victim user ID.


3) Improper Neutralization of Special Elements in Data Query Logic (CVE-ID: CVE-2026-45688)

CWE-ID: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to hijack arbitrary CAS or SAML user sessions.

The vulnerability exists due to improper neutralization of special elements in data query logic in the CAS login handler when processing a client-supplied credentialToken value in a MongoDB query. A remote attacker can send a specially crafted login request with a MongoDB query operator to hijack arbitrary CAS or SAML user sessions.

Exploitation requires that CAS or SAML be configured and that a legitimate SSO login occur within the 60-second credential-token validity window.


4) Improper Neutralization of Special Elements in Data Query Logic (CVE-ID: CVE-2026-45689)

CWE-ID: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to obtain OAuth access tokens for arbitrary users.

The vulnerability exists due to improper neutralization of special elements in data query logic in the /oauth/token endpoint when handling crafted HTTP POST requests with MongoDB query operators. A remote attacker can send a specially crafted request to obtain OAuth access tokens for arbitrary users.

Exploitation requires at least one active OAuth app and at least one stored refresh token on the target instance.


5) Missing Authentication for Critical Function (CVE-ID: CVE-2026-45677)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper authentication in SAML logout request processing when handling inbound LogoutRequest messages at the SP logout endpoint. A remote attacker can submit a valid-looking unsigned LogoutRequest for a target user to cause a denial of service.

Exploitation requires knowledge of the target user's SAML NameID.


6) Improper Authorization (CVE-ID: CVE-2026-49278)

CWE-ID: CWE-285 - Improper Authorization

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a highly privileged attacker with the view-l-room permission to obtain another Livechat visitor's bearer token and impersonate that visitor.

The vulnerability exists due to missing conversation-scope authorization in Rocket.Chat's /api/v1/livechat/visitors.info endpoint when processing visitor information requests. A highly privileged attacker can submit a valid visitor identifier outside their authorized conversation scope to retrieve the visitor's profile, including the bearer token and personal information.


7) Cross-site scripting (CVE-ID: CVE-2026-47733)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows an authenticated attacker to execute arbitrary JavaScript in a viewer's browser session through stored cross-site scripting.

The vulnerability exists due to missing URL protocol sanitization in Rocket.Chat's ImageElement component when rendering links from user-supplied markdown images. An authenticated attacker can post an image with a javascript: URL that executes when a viewer clicks it using a legacy browser that permits JavaScript URLs to open in new tabs.


Remediation

Install update from vendor's website.

References