EUVD-2026-39099Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L
Network endpoint requires high-privilege credentials; token harvesting is read-only so availability impact is none, not low.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
2DescriptionCVE.org
Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12, in the visitors.info endpoint, https://developer.rocket.chat/apidocs/get-visitor-information-by-id-1, token is returned in the response. It looks like there's no use case for the token to be present in the response and it would be a good security practice to remove it altogether. This vulnerability is fixed in 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12.
AnalysisAI
Rocket.Chat's Omnichannel visitors.info API endpoint exposes visitor session tokens in response payloads, enabling a privileged caller to capture and reuse those tokens for authentication bypass against LiveChat visitor identities. Affected deployments span multiple 7.x and 8.x release branches, with vendor-confirmed fixes across seven patch releases. No public exploit code and no CISA KEV listing exist at time of analysis; however, the CWE-285 (Improper Authorization) classification and 'Authentication Bypass' tag confirm meaningful post-exploitation potential for session impersonation.
Technical ContextAI
Rocket.Chat is an open-source team and customer communications platform with an Omnichannel/LiveChat subsystem for managing external visitor interactions. The vulnerable component is the REST API endpoint GET /v1/livechat/visitors.info, documented at https://developer.rocket.chat/apidocs/get-visitor-information-by-id-1, which retrieves metadata about a LiveChat visitor by their ID. The flaw is that the visitor's authentication token - a credential that should remain server-side - is serialized into the JSON response body returned to the API caller. CWE-285 (Improper Authorization) identifies the root cause as a failure to properly scope sensitive output in API responses, specifically the absence of field-level access controls preventing privileged callers from receiving credentials they have no legitimate need for. CPE strings were not provided in the source data; affected versions are instead enumerated explicitly in the vendor advisory.
RemediationAI
Upgrade to the nearest vendor-released fixed version matching your current deployment branch: 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, or 7.10.12. Full details are in the vendor advisory at https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-cqj7-h8cj-jmf2. If immediate patching is not feasible, restrict access to the /v1/livechat/visitors.info endpoint at the network perimeter or WAF layer to only trusted internal management systems, preventing external or lower-trust operator access; note this will break legitimate LiveChat administration workflows that depend on the endpoint. Additionally, audit Omnichannel operator account assignments and rotate any visitor tokens that may have been exposed during the vulnerable window.
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today