SB20261109213 - Multiple vulnerabilities in Rocket.Chat

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261109213

SB20261109213 - Multiple vulnerabilities in Rocket.Chat

Published: November 9, 2026

Security Bulletin ID SB20261109213
CSH Severity
High
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 33% Medium 67%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 vulnerabilities.


1) Missing Authorization (CVE-ID: CVE-2026-55762)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a low-privileged remote attacker to deregister a Rocket.Chat workspace from Rocket.Chat Cloud, disabling paid features and push notifications.

The vulnerability exists due to missing authorization checks in the authenticated /api/v1/fingerprint endpoint when processing requests with setDeploymentAs set to new-workspace. A low-privileged remote attacker can submit this POST request using a standard user account to erase workspace cloud credentials and remove its license.


2) Improper Authentication (CVE-ID: CVE-2026-55666)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to take over other users' accounts on Rocket.Chat deployments using Apple OAuth.

The vulnerability exists due to Rocket.Chat's Apple OAuth login handler trusting a request-supplied email address when the identity token lacks an email claim. An unauthenticated remote attacker can submit a forged Apple identity token without an email claim alongside a victim's email address to authenticate as that victim.


3) Authentication Bypass by Capture-replay (CVE-ID: CVE-2026-55759)

CWE-ID: CWE-294 - Authentication Bypass by Capture-replay

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to authenticate as another user on Rocket.Chat instances using Apple Sign-In.

The vulnerability exists due to missing JWT claims validation in the Apple Sign-In handler when processing signed identity tokens, including expired tokens and tokens intended for other applications. An unauthenticated remote attacker can replay an obtained Apple identity token belonging to the target user to gain account access without a replay expiration limit.


Remediation

Install update from vendor's website.

References