SB20261109214 - Multiple vulnerabilities in Rocket.Chat

Description

This security bulletin contains information about 2 vulnerabilities.

1) Missing Authorization (CVE-ID: CVE-2026-72919)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an authenticated remote attacker to convert public channels they do not own or manage into teams in Rocket.Chat.

The vulnerability exists due to missing authorization in the channels.convertToTeam REST endpoint when a request identifies a channel by channelName rather than channelId. An authenticated remote attacker can submit a channel name using the create-team permission granted to registered users by default, bypassing the channel ownership or management check.

2) Insufficient verification of data authenticity (CVE-ID: CVE-2026-72918)

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated attacker to display an ephemeral fake message in another user's currently open Rocket.Chat conversation.

The vulnerability exists due to missing sender verification in the stream-notify-user WebSocket stream, whose client interface trusts notification body parameters when generating notifications. A remote authenticated attacker can submit arbitrary messages to this stream while the victim has the affected chat open, causing fabricated content to appear.

Remediation

Install update from vendor's website.

References

• https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-4mvx-9h2h-hmg3
• https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-27jx-236m-3f5j