Rocket.Chat CVE-2026-48616
CRITICALAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify Rocket.Chat instance with Livechat enabled
-
DeliveryOpen Livechat session to obtain rc_rid and rc_token
-
ExploitEnumerate sequential MongoDB ObjectIds for fileId
-
ExecutionRequest /file-upload/:fileId/x with rc_room_type=l
-
PersistBypass per-file rid check and download arbitrary uploads
-
ImpactExfiltrate sensitive attachments across rooms
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target Rocket.Chat server has the Livechat/Omnichannel feature enabled (so the rc_room_type=l authorization branch is reachable) and that the attacker can obtain one valid rc_rid + rc_token pair, which any visitor can self-issue by initiating a Livechat session - no Rocket.Chat user account, admin role, or user interaction from a victim is needed. Limiting factors: instances with Livechat disabled are not exploitable via this path; reaching the endpoint requires network access to the Rocket.Chat HTTP service; and enumeration relies on MongoDB ObjectId predictability, which holds for default deployments but may be slowed if uploads are stored with non-default IDs. |
| Impact | The CVSS 3.0 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N (9.3 Critical) aligns with the description: network-reachable endpoint, no authentication, low complexity, scope change (Livechat trust boundary crossed to access other rooms' files), with high confidentiality impact via mass file exfiltration and low integrity impact (predictable IDs let an attacker iterate). Real-world risk is high for any internet-exposed Rocket.Chat instance that has ever enabled Livechat, because obtaining a valid rc_rid/rc_token pair is trivial - any visitor who starts a Livechat session receives one - turning this into a near-unauthenticated bulk file disclosure primitive. EPSS and CISA KEV status were not provided in the input, so widespread automated exploitation cannot yet be confirmed, but the public HackerOne report and merged upstream PR (#40889) make N-day weaponization straightforward. CVSS scope change and the C:H rating reflect the cross-tenant/cross-room impact rather than a single-room leak. |
| Exploit ScenarioDerived | An attacker opens a Livechat session on the target Rocket.Chat instance (or any instance with Livechat enabled), capturing their own valid rc_rid and rc_token. They then script GET requests to /file-upload/<incrementing MongoDB ObjectId>/x with rc_room_type=l plus their captured rc_rid/rc_token, iterating ObjectIds derived from known timestamps to bulk-download every uploaded file across all rooms and tenants, including private channel attachments and DMs. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 17, 2026
Unauthenticated information disclosure in Rocket.Chat allows remote attackers to enumerate and download arbitrary uploaded files via the Livechat file-download endpoint. The flaw at /file-upload/:fileId/:name validates rc_token against rc_rid but never checks that rc_rid matches the requested file's actual room ID, and sequential MongoDB ObjectIDs make :fileId predictable, enabling discovery of all uploads. No public exploit identified at time of analysis, but the HackerOne report (#3687142) and upstream fix PR are public.
RemediationAI
Vendor-released patch: upgrade Rocket.Chat to 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, 7.13.9, or 7.10.13 (whichever matches your current branch), tracked in PR https://github.com/RocketChat/Rocket.Chat/pull/40889 and the security hotfix notice at https://docs.rocket.chat/docs/security-fixes-and-updates. If immediate patching is not possible, disable the Livechat (Omnichannel) feature in Administration → Omnichannel, which removes the rc_room_type=l authorization path at the cost of breaking customer-facing chat; alternatively, restrict access to /file-upload/* at a reverse proxy so requests carrying rc_room_type=l, rc_rid, or rc_token cookies/query parameters are blocked or required to be authenticated, accepting that this will break legitimate Livechat file sharing. Review web/proxy access logs for high-volume sequential GET requests to /file-upload/* from a single source to detect enumeration attempts, and rotate or revoke any sensitive uploaded content that may have been exposed.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Rocket.Chat is an open-source team collaboration and customer engagement platform built on Meteor/Node.js with MongoDB persistence. The vulnerable code path serves protected uploads at /file-upload/:fileId/:name and supports Livechat (anonymous guest chat) authorization via the cookies/query params rc_room_type=l, rc_rid (room ID) and rc_token (visitor token). The CWE-284 (Improper Access Control) root cause is that the handler verifies the rc_token belongs to the room identified by rc_rid, but it does not enforce that rc_rid equals the rid attribute stored on the file document being fetched - so any valid Livechat room+token pair authorizes downloads of any file in the system. The exposure is amplified by MongoDB's default ObjectId generation, which embeds a timestamp and monotonically increasing counter, making :fileId values guessable/enumerable; the :name segment is not validated against the stored filename.
Know when Rocket Chat gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
Endpoint is internet-reachable with no auth (AV:N/AC:L/PR:N/UI:N); Livechat auth boundary is crossed to read other rooms' files (S:C, C:H); predictable IDs allow some write-side abuse via enumeration (I:L); no availability impact.
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
DescriptionCVE.org
Rocket.Chat versions <8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, 7.13.9, 7.10.13 has an access control vulnerability in Livechat files. Protected file downloads at /file-upload/:fileId/:name authorize livechat access using rc_room_type=l with rc_rid+rc_token, but the authorization path does not verify that rc_rid matches the requested file's rid. Furthermore, :fileId is predictable via sequential MongoDB IDs, and :name can be anything, allowing unauthenticated discovery of all uploaded files.
Executive ViewAI
Rocket.Chat contains a critical vulnerability (CVE-2026-48616) allowing unauthenticated remote attackers to enumerate and download arbitrary files from all chat rooms, exposing sensitive business communications and internal documents. All versions are affected with no patch currently available, creating immediate data breach risk. Organizations must urgently implement emergency controls to prevent unauthorized access to file repositories.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Implement firewall rules restricting /file-upload endpoint to internal/trusted networks only; (2) Deploy WAF rules to detect and block sequential ObjectID enumeration patterns; (3) Monitor all file download requests and alert on anomalies; (4) Disable Livechat feature if not operationally critical; (5) Apply IP whitelisting to file-download endpoints; (6) Monitor HackerOne report #3687142 and upstream fix PR for patch release timeline. Apply vendor patch immediately upon availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)CVE.org
More in Rocket Chat
View allA sanitization vulnerability exists in Rocket.Chat server versions <3.13.2, <3.12.4, <3.11.4 that allowed queries to an
A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenti
A improper authentication vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 that allowed two factor authentic
A SQL injection vulnerability exists in Rocket.Chat <v3.18.6, <v4.4.4 and <v4.7.3 which can allow an attacker to retriev
A Server-Side Request Forgery (SSRF) affects Rocket.Chat's Twilio webhook endpoint before version 6.10.1. Rated high sev
Rocket.Chat versions prior to 6.12.0 expose the OAuth applications API endpoint to any authenticated user, allowing disc
An information disclosure vulnerability exists in the Rocket.Chat server fixed v3.13, v3.12.2 & v3.11.3 that allowed ema
An improper authentication vulnerability exists in Rocket.Chat Mobile App <4.14.1.22788 that allowed an attacker with ph
A cleartext transmission of sensitive information exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 relating to Oauth token
An information disclosure vulnerability exists in Rocket.Chat <v5 due to the getUserMentionsByChannel meteor server meth
Rocket.Chat is an open-source fully customizable communications platform developed in JavaScript. Rated medium severity
A blind self XSS vulnerability exists in RocketChat LiveChat <v1.9 that could allow an attacker to trick a victim pastin
Exploit-DB