What is the CVSS score of CVE-2026-48929?

CVE-2026-48929 has a CVSS 3.0 base score of 7.5 (High). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.6%.

Which versions of Rocket.Chat are affected by CVE-2026-48929?

Rocket.Chat is vulnerable to permanent file deletion by unauthenticated remote attackers-no public exploit code identified at time of analysis, but the vulnerability is trivially exploitable.

How to fix or mitigate CVE-2026-48929?

Within 24 hours: Confirm Rocket.Chat deployment and current version(s); review file deletion audit logs for unauthorized activity. Within 7 days: Implement firewall rules to restrict Meteor DDP WebSocket connections from public internet; establish offline backup process for critical uploaded files. Within 30 days: Monitor vendor advisory updates and HackerOne report 3611837 for patch availability; prepare upgrade testing environment; consider temporarily restricting public internet access to Rocket.Chat until patch is released.

Rocket.Chat CVE-2026-48929

HIGH

Improper Authentication (CWE-287)

2026-06-16 hackerone

Authentication Bypass Rocket Chat

7.5

CVSS 3.0 · Vendor: hackerone

Severity by source

Vendor (hackerone) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

DDP method is network-reachable with no auth or user interaction (AV:N/AC:L/PR:N/UI:N); impact is file deletion only, so C:N/I:N/A:H with no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (hackerone).

CVSS VectorVendor: hackerone

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jun 17, 2026 - 00:11 vuln.today

Analysis Generated

Jun 17, 2026 - 00:11 vuln.today

DescriptionCVE.org

Rocket.Chat in versions <8.5.1, <8.4.4, <8.3.6, <8.2.6, <8.1.6, <8.0.7, <7.13.9, and <7.10.13 is vulnerable to unauthenticated file deletion. The deleteFileMessage Meteor method permanently deletes any uploaded file by ID without requiring authentication. When called via an unauthenticated DDP WebSocket connection, Meteor.userId() returns null, causing the authorization check to be skipped. Execution falls through to FileUpload.getStore('Uploads').deleteById(fileID), which removes the file from storage and database unconditionally. File IDs are discoverable from public channel message payloads and download URLs.

AnalysisAI

Unauthenticated file deletion in Rocket.Chat allows remote attackers to permanently delete arbitrary uploaded files from a target server via the deleteFileMessage Meteor method over a DDP WebSocket connection. The flaw stems from an authorization check that is silently skipped when Meteor.userId() returns null on unauthenticated DDP sessions, letting any internet-accessible attacker destroy attachments whose IDs are discoverable from public channel messages and download URLs. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Identify exposed Rocket.Chat DDP endpoint

Delivery

Open unauthenticated WebSocket session

Exploit

Harvest file IDs from public channels

Execution

Call deleteFileMessage Meteor method

Persist

Bypass null-user authorization check

Impact

Permanently destroy file in storage and DB

Access

Identify exposed Rocket.Chat DDP endpoint

Delivery

Open unauthenticated WebSocket session

Exploit

Harvest file IDs from public channels

Execution

Call deleteFileMessage Meteor method

Persist

Bypass null-user authorization check

Impact

Permanently destroy file in storage and DB

Vulnerability AssessmentAI

Exploitation	The target must run a Rocket.Chat server older than the fixed versions (8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, 7.13.9, 7.10.13) with its DDP WebSocket endpoint (typically /websocket on the same port as HTTP) reachable by the attacker - no account, API token, user interaction, or non-default configuration is required, matching AV:N/AC:L/PR:N/UI:N. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.0 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H scores 7.5 and aligns cleanly with the description: network-reachable DDP endpoint, no authentication or user interaction, low complexity, and a pure availability impact (file destruction) with no read/modify primitive. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker opens a raw DDP WebSocket to a public Rocket.Chat server, scrapes file IDs from messages in public channels (or from leaked download URLs), and issues method calls to deleteFileMessage with each ID; because Meteor.userId() is null on the unauthenticated socket, the authorization check is bypassed and each file is permanently removed from both storage and the database. The attack is scriptable in a few lines of JavaScript against any vulnerable instance, making it suitable for targeted sabotage of evidence, support transcripts, or shared design assets.
Remediation	Upgrade Rocket.Chat to one of the fixed versions on your maintenance line: 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, 7.13.9, or 7.10.13, per the upstream patch in https://github.com/RocketChat/Rocket.Chat/pull/40889/ and the security advisory referenced from https://docs.rocket.chat/docs/security-fixes-and-updates. … Detailed patch versions, workarounds, and compensating controls in full report.