What is the CVSS score of CVE-2026-29197?

CVE-2026-29197 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-29197?

Yes, a patch is available for CVE-2026-29197. Update the affected software to the latest version immediately.

Rocket.Chat CVE-2026-29197

Q: Which versions of Rocket.Chat are affected by CVE-2026-29197?

Authenticated users in Rocket.Chat versions prior to 8.4.0, 8.3.2, 8.2.2, 8.1.3, 8.0.4, 7.13.6, 7.12.7, 7.11.7, and 7.10.10 can read application engine logs via the /api/apps/logs and…. A patch is available.

EUVD-2026-25349 MEDIUM

Improper Access Control (CWE-284)

2026-04-23 hackerone

GHSA-37hj-44gj-w9gc

Authentication Bypass Rocket Chat

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Apr 28, 2026 - 19:34 nvd

Patch available

Analysis Generated

Apr 24, 2026 - 17:31 vuln.today

CVSS changed

Apr 24, 2026 - 15:22 NVD

4.3 (None) 4.3 (MEDIUM)

Patch available

Apr 24, 2026 - 02:01 EUVD

EUVD ID Assigned

Apr 23, 2026 - 23:45 euvd

EUVD-2026-25349

Analysis Generated

Apr 23, 2026 - 23:45 vuln.today

CVE Published

Apr 23, 2026 - 23:19 nvd

MEDIUM 4.3

DescriptionCVE.org

In versions <8.4.0, <8.3.2, <8.2.2, <8.1.3, <8.0.4, <7.13.6, <7.12.7, <7.11.7, and <7.10.10, the endpoints /api/apps/logs and /api/apps/:id/logs have a typo in the required permission check, allowing authenticated users without the proper permissions to read apps-engine logs.

AnalysisAI

Authenticated users in Rocket.Chat versions prior to 8.4.0, 8.3.2, 8.2.2, 8.1.3, 8.0.4, 7.13.6, 7.12.7, 7.11.7, and 7.10.10 can read application engine logs via the /api/apps/logs and /api/apps/:id/logs endpoints due to a typo in permission validation logic. The vulnerability allows authenticated attackers with insufficient privileges to bypass authorization checks and access sensitive logs containing partial information, with no public exploit confirmed at time of analysis.

Technical ContextAI

The vulnerability exists in Rocket.Chat's REST API permission enforcement layer, specifically in the endpoint handlers for /api/apps/logs and /api/apps/:id/logs. A typo in the permission check (CWE-284: Improper Access Control) causes the authorization logic to fail to properly validate whether authenticated users possess the required permissions to access application engine logs. This is a logic error in the permission validation code path rather than a cryptographic or authentication bypass. The affected product is identified by CPE cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:*, indicating all releases of Rocket.Chat are potentially in scope depending on version. The flaw affects the middleware or endpoint-specific authorization decorator that should restrict log access to users with explicit app-related administrative or access permissions.

RemediationAI

Upgrade to Rocket.Chat version 8.4.0 or later for the 8.x branch, or to version 7.13.6, 7.12.7, 7.11.7, or 7.10.10 depending on your current branch; these patch releases include the permission validation fix from GitHub PR #40125. Organizations unable to upgrade immediately should restrict network access to the /api/apps/logs and /api/apps/:id/logs endpoints at the reverse proxy or API gateway level using IP whitelisting or authentication token inspection, limiting access to administrative staff only. A second compensating control is to audit the 'Authentication' header and 'Authorization' scope in HTTP access logs to identify unauthorized log endpoint requests; this does not block the vulnerability but enables detection of exploitation attempts. Note that blocking these endpoints may prevent legitimate application logging queries if your installation relies on them for diagnostics, so test the impact in a non-production environment first. The vendor advisory and patched code are available at https://github.com/RocketChat/Rocket.Chat/pull/40125 and https://nvd.nist.gov/vuln/detail/CVE-2026-29197.