Rocket.chat vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-65644 Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, and 7.10.15 has a REST API endpoint POST /api/v1/livechat/visitor that acHigh 7.5 · Aug 21, 2026
• CVE-2026-56845 An unauthenticated path traversal (LFI) vulnerability exists under /custom-sounds/ when CustomSounds storage is configured to FileSystem.High 7.5 · Aug 3, 2026
• CVE-2026-58066 Rocket.Chat's SAML SSO before versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8, and 7.10.14 verified XML signatures but did not bind the validateCritical 9.8 · Jul 30, 2026
• CVE-2026-48929 Rocket.Chat in versions <8.5.1, <8.4.4, <8.3.6, <8.2.6, <8.1.6, <8.0.7, <7.13.9, and <7.10.13 is vulnerable to unauthenticated file deletion.High 7.5 · Jun 17, 2026
• CVE-2026-48616 Rocket.Chat versions <8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, 7.13.9, 7.10.13 has an access control vulnerability in Livechat files.Critical 9.3 · Jun 17, 2026
• CVE-2026-32995 The Rocket.Chat DDP method autoTranslate.translateMessage in versions <8.5.0, <8.4.2, <8.3.4, <8.2.4, <8.1.5, <8.0.5, <7.13.8, and <7.10.12 accepts a client-supHigh 7.5 · May 28, 2026
• CVE-2026-29198 In Rocket.Chat <8.3.0, <8.2.1, <8.1.2, <8.0.3, <7.13.5, <7.12.6, <7.11.6, and <7.10.9, a NoSQL injection vulnerability can lead to account takeover of the firstCritical 9.8 · Apr 22, 2026
• CVE-2025-7974 rocket.chat Incorrect Authorization Information Disclosure Vulnerability.High 7.5 · Sep 2, 2025
• CVE-2024-46935 Rocket.Chat 6.12.0, 6.11.2, 6.10.5, 6.9.6, 6.8.6, 6.7.8, and earlier is vulnerable to denial of service (DoS).High 7.5 · Sep 24, 2024
• CVE-2024-39713 A Server-Side Request Forgery (SSRF) affects Rocket.Chat's Twilio webhook endpoint before version 6.10.1.High 8.6 · Aug 5, 2024
• CVE-2024-29151 Rocket.Chat.Audit through 5ad78e8 depends on filecachetools, which does not exist in PyPI.Critical 9.1 · Mar 18, 2024
• CVE-2023-28356 A vulnerability has been identified where a maliciously crafted message containing a specific chain of characters can cause the chat to enter a hot loop on one High 7.5 · May 11, 2023
• CVE-2023-28316 A security vulnerability has been discovered in the implementation of 2FA on the rocket.chat platform, where other active sessions are not invalidated upon actiCritical 9.8 · May 9, 2023
• CVE-2023-23911 An improper access control vulnerability exists prior to v6 that could allow an attacker to break the E2E encryption of a chat room by a user changing the groupHigh 7.5 · Mar 10, 2023
• CVE-2023-23917 A prototype pollution vulnerability exists in Rocket.Chat server <5.2.0 that could allow an attacker to a RCE under the admin account.High 8.8 · Feb 23, 2023
• CVE-2022-44567 A command injection vulnerability exists in Rocket.Chat-Desktop <3.8.14 that could allow an attacker to pass a malicious url of openInternalVideoChatWindow to sCritical 9.8 · Dec 23, 2022
• CVE-2022-35248 A improper authentication vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 that allowed two factor authentication can be bypassed when telling the sHigh 8.8 · Sep 23, 2022
• CVE-2022-32211 A SQL injection vulnerability exists in Rocket.Chat <v3.18.6, <v4.4.4 and <v4.7.3 which can allow an attacker to retrieve a reset password token through or a 2fHigh 8.8 · Sep 23, 2022
• CVE-2021-22910 A sanitization vulnerability exists in Rocket.Chat server versions <3.13.2, <3.12.4, <3.11.4 that allowed queries to an endpoint which could result in a NoSQL iCritical 9.8 · Aug 9, 2021
• CVE-2020-26763 The Rocket.Chat desktop application 2.17.11 opens external links without user interaction.High 7.5 · Jul 5, 2021
• CVE-2021-22911 A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenticated NoSQL injection, resulting potentiCritical 9.8 · May 27, 2021
• CVE-2021-22892 An information disclosure vulnerability exists in the Rocket.Chat server fixed v3.13, v3.12.2 & v3.11.3 that allowed email addresses to be disclosed by enumeratHigh 7.5 · May 27, 2021
• CVE-2020-29594 Rocket.Chat before 0.74.4, 1.x before 1.3.4, 2.x before 2.4.13, 3.x before 3.7.3, 3.8.x before 3.8.3, and 3.9.x before 3.9.1 mishandles SAML login.Critical 9.8 · Dec 30, 2020
• CVE-2017-1000493 Rocket.Chat Server version 0.59 and prior is vulnerable to a NoSQL injection leading to administrator account takeoverCritical 9.8 · Jan 2, 2018