Rocket.Chat CVE-2026-65645

Exploitation requires a valid Rocket.Chat user account at any privilege level - there is no unauthenticated exploitation path, as confirmed by CVSS PR:L. No special role, administrator permissions, or non-default server configuration is required beyond possessing an active session. The attack targets the DDP WebSocket interface, which is the standard real-time communication channel enabled by default on every Rocket.Chat deployment; it is not a feature that must be explicitly turned on. The attacker must additionally have legitimate membership in at least one room so that the authorization check resolves successfully before the fan-out query executes. What limits exploitation: the attacker must be able to reach the WebSocket endpoint (network access required); completely air-gapped or VPN-only deployments reduce exposure to insider threats only. The confidentiality impact is scoped to thread content (parent messages and replies) - non-threaded channel messages are not exposed through this specific method pair.

The vendor-assigned CVSS of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) likely understates the confidentiality impact by rating C:L. The injection causes MongoDB queries to fan out across ALL rooms - enabling full read of all private thread content system-wide - which is more accurately represented as C:H, yielding a base score of approximately 6.5. EPSS at 0.14% (4th percentile) reflects low observed exploitation probability, and there is no CISA KEV listing. However, the attack requires only a valid Rocket.Chat account (PR:L), no special configuration, and is executable over a standard WebSocket session - the effective barrier is far lower than the EPSS percentile suggests for a newly disclosed CVE. The vulnerability mechanism is inferable from the public GitHub PR diff at pull/41814, which shows the exact typeof checks added and the switch from user-supplied IDs to server-resolved identifiers, making independent rediscovery realistic for any researcher examining the changeset. Organizations using Rocket.Chat for sensitive internal communications where thread confidentiality is a core assumption should treat this as higher priority than the raw CVSS implies.

An attacker holding any valid Rocket.Chat account - such as a newly invited contractor or a user registered on an open-registration instance - opens a browser developer console during an active session and sends a raw DDP method call to getThreadsList substituting {"$gt": ""} for the expected rid string parameter. The server authorization check resolves this operator against a room the attacker already has access to, passing authorization, while the MongoDB query fans out across all rooms and returns thread listings from private channels and direct messages the attacker was never invited to. The attacker then iterates thread IDs and calls getThreadMessages with operator-injected tmid values to retrieve the full content of those private conversations. No public exploit code has been identified at time of analysis.