EUVD-2026-39097Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:N for REST API access, AC:H because exploitation depends on the specific idle-deactivation workflow and retained token; PR:L because the attacker previously held valid user credentials on the instance.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
2DescriptionCVE.org
Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12, Rocket.Chat allows users deactivated through users.deactivateIdle to keep using already-issued login tokens. A user that an administrator has marked inactive for idleness can still access authenticated REST endpoints with the old token. This vulnerability is fixed in 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12.
AnalysisAI
Insufficient session expiration in Rocket.Chat allows users administratively deactivated via the users.deactivateIdle mechanism to continue accessing authenticated REST API endpoints using previously-issued login tokens that were never invalidated. All Rocket.Chat deployments across the 7.x and 8.x release branches prior to the fixed versions are affected. No public exploit has been identified and the CVSS 4.0 score of 2.3 reflects genuinely low real-world risk given high attack complexity, limited impact, and the requirement for a specific idle-deactivation administrative workflow.
Technical ContextAI
Rocket.Chat is an open-source team communications platform offering REST API endpoints protected by session tokens issued at login. The affected mechanism, users.deactivateIdle, is an administrative API that marks idle users as inactive rather than revoking their credentials. CWE-613 (Insufficient Session Expiration) describes the root cause: the platform does not invalidate or revoke login tokens when the associated account transitions to a deactivated state via this specific code path. Token-based authentication systems must actively blacklist or expire existing tokens upon privilege change or account deactivation; the absence of this invalidation step is the technical failure here. The GitHub Security Advisory GHSA-6g3w-vg5p-w892 is the primary reference. No CPE strings were provided in the intelligence data.
RemediationAI
Upgrade to one of the vendor-patched releases: 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, or 8.0.6 in the 8.x branch, or 7.13.8 and 7.10.12 in the 7.x branch. These versions are confirmed fixed per the GitHub Security Advisory GHSA-6g3w-vg5p-w892. If immediate upgrade is not feasible, administrators can mitigate by supplementing users.deactivateIdle with an explicit token-revocation step - Rocket.Chat's admin API exposes a users.logout endpoint that can be called for each deactivated user to force session termination; this adds operational overhead but eliminates the residual token risk. A second workaround is to enforce short token expiry intervals via Rocket.Chat's account security settings, reducing the window during which a stale token remains valid at the cost of more frequent re-authentication for all users. Neither workaround fully eliminates the root cause; patching is the preferred path.
Same weakness CWE-613 – Insufficient Session Expiration
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today