Rocket.Chat CVE-2026-32994

Exploitation requires a valid authenticated Rocket.Chat user account (CVSS PR:L); unauthenticated attackers cannot exploit this vulnerability. The attacker must also supply a valid messageId for a message stored in a room they are not a member of - this is the basis for the CVSS AC:H rating, as the attacker must obtain or enumerate these IDs. The autotranslate feature must be enabled on the Rocket.Chat instance (this is not confirmed as enabled by default - operators should verify their configuration). There is no required user interaction beyond the attacker's own API call (UI:N). Exploitation is limited to confidentiality impact only; no write or availability primitive is exposed. The practical difficulty of ID enumeration may be lower than AC:H implies if message IDs follow predictable patterns, which would elevate real-world risk above the CVSS score suggests.

The CVSS 5.3 score reflects a nuanced threat profile: AV:N confirms remote exploitation via the API, PR:L confirms an authenticated session is required (eliminating unauthenticated mass exploitation), and AC:H signals that the attacker must possess or successfully enumerate valid message IDs from rooms they do not belong to - the primary friction point. C:H drives the confidentiality severity, with no integrity or availability impact (I:N/A:N). EPSS data was not provided in the available intelligence, so exploitation probability cannot be quantified beyond the CVSS signals. There is no CISA KEV listing and no confirmed public POC, meaning this is currently a theoretical-to-low active exploitation risk. However, organizations with large user bases (many internal authenticated accounts, including contractors or lower-trust staff) face meaningful insider-threat exposure. The AC:H rating may also be optimistic: Rocket.Chat message IDs are typically sequential or ULID-based, which could lower practical enumeration difficulty beyond what the CVSS reflects - this should be verified with the vendor.

An authenticated attacker - such as a low-privileged employee, contractor, or compromised internal account - submits a crafted POST request to /api/v1/autotranslate.translateMessage with a target messageId harvested or enumerated from the Rocket.Chat platform. Because no room membership check is performed, the server returns the complete IMessage object including the text of a private direct message or confidential group conversation the attacker has never been invited to. No public POC has been identified at time of analysis, but the attack requires only standard HTTP tooling and a valid session token.