What is the CVSS score of CVE-2026-32995?

CVE-2026-32995 has a CVSS 3.0 base score of 7.5 (High). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Rocket.Chat are affected by CVE-2026-32995?

Rocket.Chat deployments are exposed to unauthorized message disclosure (CVE-2026-32995, CVSS 7.5), where any authenticated user can read messages from all channels regardless of access permissions,…. A patch is available.

How to fix or mitigate CVE-2026-32995?

Within 24 hours: identify all Rocket.Chat deployments and document their versions for vulnerability status. Within 7 days: contact Rocket.Chat support for release timeline of a patched version and implement access logging on the autoTranslate method. Within 30 days: apply vendor-released patch immediately upon availability or upgrade to patched version; audit recent message access logs for unauthorized message retrieval patterns.

Rocket.Chat CVE-2026-32995

EUVD-2026-32711 HIGH

Improper Access Control (CWE-284)

2026-05-28 hackerone

GHSA-2v6f-4wc2-p3hq

Authentication Bypass Rocket Chat

7.5

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

May 28, 2026 - 06:01 EUVD

Source Code Evidence Fetched

May 28, 2026 - 05:02 vuln.today

Analysis Generated

May 28, 2026 - 05:02 vuln.today

DescriptionCVE.org

The Rocket.Chat DDP method autoTranslate.translateMessage in versions <8.5.0, <8.4.2, <8.3.4, <8.2.4, <8.1.5, <8.0.5, <7.13.8, and <7.10.12 accepts a client-supplied IMessage object and passes it directly to translateMessage() without checking Meteor.userId() or verifying room membership. Any authenticated DDP user can read the content of any message by ID from any room (private channels, DMs, E2EE rooms) by calling this method.

AnalysisAI

Cross-room message disclosure in Rocket.Chat allows any authenticated DDP user to read arbitrary messages - including those in private channels, direct messages, and E2EE rooms - by invoking the autoTranslate.translateMessage Meteor method with a target message ID. The flaw stems from missing access control and identity checks in the server-side method handler, with an upstream fix merged in PR #40528. No public exploit identified at time of analysis, though the trivial DDP call pattern makes weaponization straightforward.

Technical ContextAI

Rocket.Chat is an open-source team collaboration platform built on the Meteor framework, which exposes server methods to clients via the DDP (Distributed Data Protocol) websocket protocol. The vulnerable code path is apps/meteor/app/autotranslate/server/methods/translateMessage.ts, where the method previously accepted a client-supplied IMessage object and forwarded it directly to translateMessage() without calling Meteor.userId() to confirm the caller's identity, without type-checking the message ID, and without invoking canAccessRoomAsync() to verify the caller is a member of the room containing the message. This is a textbook CWE-284 (Improper Access Control) failure: the server trusted client-provided object structure and treated the input as a read-through key to MongoDB rather than an authorization-gated lookup. Because Meteor methods can be invoked directly over DDP outside the normal UI flow, the missing checks expose the full message corpus including private channels, DMs, and even messages stored from E2EE rooms (where ciphertext is still server-side and may be cached/translated).

RemediationAI

Vendor-released patch: upgrade to Rocket.Chat 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.5, 7.13.8, or 7.10.12 (whichever matches your release line), which incorporate the access-control fix from https://github.com/RocketChat/Rocket.Chat/pull/40528 that adds Meteor.userId() validation, type-checks message._id with meteor/check, re-fetches the message server-side, and gates translation behind canAccessRoomAsync(). If immediate patching is not possible, compensating controls include disabling the AutoTranslate feature globally via the AutoTranslate_Enabled setting (side effect: legitimate users lose in-product translation), restricting account creation by disabling open self-registration (Accounts_RegistrationForm) to shrink the attacker pool to existing users, and placing the Rocket.Chat instance behind a network-level allowlist or VPN if external access is not required (side effect: blocks legitimate remote users). Monitor server logs for high-volume calls to the autoTranslate.translateMessage DDP method from individual sessions as a detection signal.