Insufficient verification of data authenticity in Rocket.Chat - CVE-2026-72918
Published: November 9, 2026
Vulnerability identifier: #VU163161
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-72918
CWE-ID: CWE-345
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote authenticated attacker to display an ephemeral fake message in another user's currently open Rocket.Chat conversation.
The vulnerability exists due to missing sender verification in the stream-notify-user WebSocket stream, whose client interface trusts notification body parameters when generating notifications. A remote authenticated attacker can submit arbitrary messages to this stream while the victim has the affected chat open, causing fabricated content to appear.
Affected software
Rocket.Chat
How to mitigate CVE-2026-72918
Install security update from vendor's website.
Rocket.Chat - addressed in versions 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, 8.6.1