What is the CVSS score of CVE-2026-48929?

CVE-2026-48929 has a CVSS 3.0 base score of 7.5 (High). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.6%.

Which versions of Rocket.Chat are affected by CVE-2026-48929?

Rocket.Chat is vulnerable to permanent file deletion by unauthenticated remote attackers-no public exploit code identified at time of analysis, but the vulnerability is trivially exploitable.

How to fix or mitigate CVE-2026-48929?

Within 24 hours: Confirm Rocket.Chat deployment and current version(s); review file deletion audit logs for unauthorized activity. Within 7 days: Implement firewall rules to restrict Meteor DDP WebSocket connections from public internet; establish offline backup process for critical uploaded files. Within 30 days: Monitor vendor advisory updates and HackerOne report 3611837 for patch availability; prepare upgrade testing environment; consider temporarily restricting public internet access to Rocket.Chat until patch is released.

Rocket.Chat CVE-2026-48929

HIGH

Improper Authentication (CWE-287)

2026-06-16 hackerone

Authentication Bypass Rocket Chat

7.5

CVSS 3.0 · Vendor: hackerone

Severity by source

Vendor (hackerone) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

DDP method is network-reachable with no auth or user interaction (AV:N/AC:L/PR:N/UI:N); impact is file deletion only, so C:N/I:N/A:H with no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (hackerone).

CVSS VectorVendor: hackerone

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jun 17, 2026 - 00:11 vuln.today

Analysis Generated

Jun 17, 2026 - 00:11 vuln.today

DescriptionCVE.org

Rocket.Chat in versions <8.5.1, <8.4.4, <8.3.6, <8.2.6, <8.1.6, <8.0.7, <7.13.9, and <7.10.13 is vulnerable to unauthenticated file deletion. The deleteFileMessage Meteor method permanently deletes any uploaded file by ID without requiring authentication. When called via an unauthenticated DDP WebSocket connection, Meteor.userId() returns null, causing the authorization check to be skipped. Execution falls through to FileUpload.getStore('Uploads').deleteById(fileID), which removes the file from storage and database unconditionally. File IDs are discoverable from public channel message payloads and download URLs.

AnalysisAI

Unauthenticated file deletion in Rocket.Chat allows remote attackers to permanently delete arbitrary uploaded files from a target server via the deleteFileMessage Meteor method over a DDP WebSocket connection. The flaw stems from an authorization check that is silently skipped when Meteor.userId() returns null on unauthenticated DDP sessions, letting any internet-accessible attacker destroy attachments whose IDs are discoverable from public channel messages and download URLs. No public exploit identified at time of analysis, though a vendor patch and HackerOne disclosure (report 3611837) confirm the issue.

Technical ContextAI

Rocket.Chat is a Meteor.js-based team collaboration platform that exposes server-side methods to clients over the DDP (Distributed Data Protocol) WebSocket transport. The vulnerable deleteFileMessage Meteor method calls FileUpload.getStore('Uploads').deleteById(fileID) - which unconditionally removes the underlying file from the upload store (e.g., GridFS, S3, FileSystem) and its database record - but its authorization guard only validates the caller when Meteor.userId() returns a real user; on an unauthenticated DDP connection that returns null, the guard is short-circuited rather than failing closed. This is a textbook CWE-287 (Improper Authentication) issue: a 'null user' path bypasses access control entirely, and because file IDs leak in public channel message payloads and CDN-style download URLs, IDs are not a meaningful secret. The CPE cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:* indicates all Rocket.Chat server versions prior to the listed fixes are in scope.

RemediationAI

Upgrade Rocket.Chat to one of the fixed versions on your maintenance line: 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, 7.13.9, or 7.10.13, per the upstream patch in https://github.com/RocketChat/Rocket.Chat/pull/40889/ and the security advisory referenced from https://docs.rocket.chat/docs/security-fixes-and-updates. If immediate upgrade is not possible, restrict network access to the Rocket.Chat DDP/WebSocket endpoint (the same host:port as HTTP, path /websocket) so it is only reachable from authenticated reverse proxies or VPN clients, and make public channels private until patched - this prevents unauthenticated clients from opening DDP sessions and from enumerating file IDs from public message payloads, at the cost of breaking anonymous browsing and third-party integrations that rely on DDP. Restoring deleted files requires backups of both the upload store and MongoDB, so verify backup coverage before exposure.