What is the CVSS score of CVE-2026-48616?

CVE-2026-48616 has a CVSS 3.0 base score of 9.3 (Critical). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of Rocket.Chat are affected by CVE-2026-48616?

Rocket.Chat contains a critical vulnerability (CVE-2026-48616) allowing unauthenticated remote attackers to enumerate and download arbitrary files from all chat rooms, exposing sensitive business…

How to fix or mitigate CVE-2026-48616?

Within 24 hours: Identify all Rocket.Chat deployments and document versions; assess network exposure of the /file-upload endpoint; review logs for suspicious file enumeration patterns. Within 7 days: Restrict /file-upload endpoint access via firewall/WAF to internal networks only; implement rules blocking sequential MongoDB ObjectID requests; monitor Rocket.Chat security advisories for patch announcements. Within 30 days: Deploy vendor patch immediately upon release; conduct forensic analysis of file access logs to identify any unauthorized downloads during the vulnerability window.

Rocket.Chat CVE-2026-48616

CRITICAL

Improper Access Control (CWE-284)

2026-06-16 hackerone

Authentication Bypass Rocket Chat

9.3

CVSS 3.0 · Vendor: hackerone

Severity by source

Vendor (hackerone) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

vuln.today AI

9.3 CRITICAL

Endpoint is internet-reachable with no auth (AV:N/AC:L/PR:N/UI:N); Livechat auth boundary is crossed to read other rooms' files (S:C, C:H); predictable IDs allow some write-side abuse via enumeration (I:L); no availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (hackerone).

CVSS VectorVendor: hackerone

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jun 17, 2026 - 00:12 vuln.today

Analysis Generated

Jun 17, 2026 - 00:12 vuln.today

DescriptionCVE.org

Rocket.Chat versions <8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, 7.13.9, 7.10.13 has an access control vulnerability in Livechat files. Protected file downloads at /file-upload/:fileId/:name authorize livechat access using rc_room_type=l with rc_rid+rc_token, but the authorization path does not verify that rc_rid matches the requested file's rid. Furthermore, :fileId is predictable via sequential MongoDB IDs, and :name can be anything, allowing unauthenticated discovery of all uploaded files.

AnalysisAI

Unauthenticated information disclosure in Rocket.Chat allows remote attackers to enumerate and download arbitrary uploaded files via the Livechat file-download endpoint. The flaw at /file-upload/:fileId/:name validates rc_token against rc_rid but never checks that rc_rid matches the requested file's actual room ID, and sequential MongoDB ObjectIDs make :fileId predictable, enabling discovery of all uploads. No public exploit identified at time of analysis, but the HackerOne report (#3687142) and upstream fix PR are public.

Technical ContextAI

Rocket.Chat is an open-source team collaboration and customer engagement platform built on Meteor/Node.js with MongoDB persistence. The vulnerable code path serves protected uploads at /file-upload/:fileId/:name and supports Livechat (anonymous guest chat) authorization via the cookies/query params rc_room_type=l, rc_rid (room ID) and rc_token (visitor token). The CWE-284 (Improper Access Control) root cause is that the handler verifies the rc_token belongs to the room identified by rc_rid, but it does not enforce that rc_rid equals the rid attribute stored on the file document being fetched - so any valid Livechat room+token pair authorizes downloads of any file in the system. The exposure is amplified by MongoDB's default ObjectId generation, which embeds a timestamp and monotonically increasing counter, making :fileId values guessable/enumerable; the :name segment is not validated against the stored filename.

RemediationAI

Vendor-released patch: upgrade Rocket.Chat to 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, 7.13.9, or 7.10.13 (whichever matches your current branch), tracked in PR https://github.com/RocketChat/Rocket.Chat/pull/40889 and the security hotfix notice at https://docs.rocket.chat/docs/security-fixes-and-updates. If immediate patching is not possible, disable the Livechat (Omnichannel) feature in Administration → Omnichannel, which removes the rc_room_type=l authorization path at the cost of breaking customer-facing chat; alternatively, restrict access to /file-upload/* at a reverse proxy so requests carrying rc_room_type=l, rc_rid, or rc_token cookies/query parameters are blocked or required to be authenticated, accepting that this will break legitimate Livechat file sharing. Review web/proxy access logs for high-volume sequential GET requests to /file-upload/* from a single source to detect enumeration attempts, and rotate or revoke any sensitive uploaded content that may have been exposed.