Improper Authorization in Rocket.Chat - CVE-2026-49278
Published: November 9, 2026
Vulnerability identifier: #VU163155
CSH Severity: Low
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-49278
CWE-ID: CWE-285
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a highly privileged attacker with the view-l-room permission to obtain another Livechat visitor's bearer token and impersonate that visitor.
The vulnerability exists due to missing conversation-scope authorization in Rocket.Chat's /api/v1/livechat/visitors.info endpoint when processing visitor information requests. A highly privileged attacker can submit a valid visitor identifier outside their authorized conversation scope to retrieve the visitor's profile, including the bearer token and personal information.
Affected software
Rocket.Chat
How to mitigate CVE-2026-49278
Install security update from vendor's website.
Rocket.Chat - addressed in versions 7.10.12, 7.13.8, 8.0.6, 8.1.5, 8.2.4, 8.3.4, 8.4.2, 8.5.0