What is the CVSS score of CVE-2026-55762?

CVE-2026-55762 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-55762?

Yes, a patch is available for CVE-2026-55762. Update the affected software to the latest version immediately.

Rocket Chat CVE-2026-55762

EUVD-2026-39121 HIGH

Missing Authorization (CWE-862)

2026-06-24 GitHub_M

Authentication Bypass Rocket Chat Rocketchat

8.1

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

vuln.today AI

8.1 HIGH

Any authenticated low-privilege user can call a network endpoint with no UI (PR:L, AV:N, AC:L, UI:N); destructive deregistration harms integrity and availability but exposes no data, so C:N, I:H, A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 24, 2026 - 23:03 EUVD

Analysis Generated

Jun 24, 2026 - 22:15 vuln.today

CVE Published

Jun 24, 2026 - 21:08 cve.org

HIGH 8.1

DescriptionCVE.org

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13, the POST /api/v1/fingerprint REST endpoint enforces authentication (authRequired: true) but performs no authorization check. Any authenticated user - including a standard user role account - can call this endpoint with {"setDeploymentAs": "new-workspace"} to permanently deregister the workspace from Rocket.Chat Cloud. This wipes all cloud credentials, removes the workspace license, breaks push notifications for all users, and requires manual re-registration to recover. This vulnerability is fixed in 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13.

AnalysisAI

Unauthorized workspace deregistration in Rocket.Chat versions prior to fixed releases allows any authenticated user to permanently disconnect the workspace from Rocket.Chat Cloud. The vulnerability stems from missing authorization checks on the /api/v1/fingerprint REST endpoint, enabling low-privilege users to wipe cloud credentials, remove licenses, and break push notifications for all users. No active exploitation or public exploit code has been identified, and the EPSS score indicates low exploitation probability despite a high CVSS severity.