What is the CVSS score of CVE-2026-23477?

CVE-2026-23477 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Rocket.Chat are affected by CVE-2026-23477?

Organizations using Rocket.Chat face notable risk from CVE-2026-23477, a improper privilege management vulnerability rated CVSS 7.7.

Is there a public PoC exploit available for CVE-2026-23477?

Yes, a public proof-of-concept exploit is available for CVE-2026-23477. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-23477?

Within 7 days: Identify all affected systems running Rocket.Chat and apply vendor patches promptly. Monitor vendor channels for patch availability.

Rocket.Chat CVE-2026-23477

HIGH

Improper Privilege Management (CWE-269)

2026-01-14 security-advisories@github.com

Privilege Escalation Rocket.Chat

7.7

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Jan 26, 2026 - 18:03 vuln.today

Public exploit code

CVE Published

Jan 14, 2026 - 19:16 nvd

HIGH 7.7

DescriptionGitHub Advisory

Rocket.Chat is an open-source, secure, fully customizable communications platform. In Rocket.Chat versions up to 6.12.0, the API endpoint GET /api/v1/oauth-apps.get is exposed to any authenticated user, regardless of their role or permissions. This endpoint returns an OAuth application, as long as the user knows its ID, including potentially sensitive fields such as client_id and client_secret. This vulnerability is fixed in 6.12.0.

AnalysisAI

Rocket.Chat versions prior to 6.12.0 expose the OAuth applications API endpoint to any authenticated user, allowing disclosure of sensitive credentials including client IDs and secrets regardless of user role or permissions. An attacker with valid credentials can enumerate OAuth applications and extract their secrets by knowing application IDs, potentially compromising integrated third-party applications. Public exploit code exists for this vulnerability and no patch is currently available.

Technical ContextAI

Classified as CWE-269 (Improper Privilege Management). Affects Rocket.Chat. Rocket.Chat is an open-source, secure, fully customizable communications platform. In Rocket.Chat versions up to 6.12.0, the API endpoint GET /api/v1/oauth-apps.get is exposed to any authenticated user, regardless of their role or permissions. This endpoint returns an OAuth application, as long as the user knows its ID, including potentially sensitive fields such as client_id and client_secret. This vulnerability is fixed in 6.12.0.