Rocket.Chat CVE-2026-65644

The Omnichannel/Livechat feature must be explicitly enabled in the Rocket.Chat administration settings - it is not universally active by default and requires deliberate configuration. The affected version must be running below 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, or 7.10.15. Payload planting via POST /api/v1/livechat/visitor requires no authentication (PR:N per CVSS vector). The injected HTML renders - and the social-engineering or XSS impact is realized - only when a support agent opens and views the Omnichannel Queue side panel in their browser, making agent UI interaction a limiting prerequisite. No special OS, platform, or network topology is required beyond the attacker having HTTP access to the Rocket.Chat REST API port.

The assigned CVSS score of 7.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N warrants critical scrutiny on two metrics. First, the UI:N rating is inconsistent with stored XSS mechanics: the injected payload only renders when an agent actively opens the Omnichannel Queue panel, making agent interaction an implicit prerequisite - a proper assessment should use UI:R, which reduces the effective exploitability. Second, the S:U (Unchanged) scope may understate risk if full script execution within the agent's authenticated browser session is achievable via dangerouslySetInnerHTML, since that would cross a security boundary from the attacker's visitor context into the agent's privileged session. However, the CVE description specifically describes link injection for social engineering rather than confirmed script execution, leaving actual scope impact uncertain. Counterbalancing the CVSS severity, the EPSS score of 0.18% (8th percentile) signals very low opportunistic exploitation interest, and the absence of a CISA KEV listing confirms no verified active exploitation at time of analysis. The practical threat is narrower than the CVSS score implies: it requires Omnichannel to be enabled, a victim agent to view the queue, and relies on social engineering rather than direct code execution.

An external attacker sends a single unauthenticated POST request to /api/v1/livechat/visitor with a name field containing crafted HTML such as an anchor tag pointing to an attacker-controlled phishing domain with convincing social-engineering text (e.g., a fake security alert or account-verification prompt). The payload is stored in the Rocket.Chat database without sanitization. When any support agent opens the Omnichannel Queue side panel, InquireSidePanelItem.tsx renders the stored name via dangerouslySetInnerHTML, injecting the fully clickable phishing link into the agent's browser DOM, where a click can deliver credentials to the attacker's server.