What is the CVSS score of EUVD-2026-30835?

EUVD-2026-30835 has a CVSS 3.0 base score of 5.3 (Medium). CVSS vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-30835?

Yes, a patch is available for EUVD-2026-30835. Update the affected software to the latest version immediately.

Rocket.Chat EUVD-2026-30835

Q: Which versions of Rocket.Chat are affected by EUVD-2026-30835?

Broken access control on the /api/v1/autotranslate.translateMessage endpoint in Rocket.Chat allows any authenticated user to retrieve the full content of messages from rooms they have no membership…. A patch is available.

| CVE-2026-32994 MEDIUM

Improper Access Control (CWE-284)

2026-05-19 hackerone

GHSA-wm7g-8c9r-vg8p

Authentication Bypass Rocket Chat

5.3

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

May 19, 2026 - 06:01 EUVD

Analysis Generated

May 19, 2026 - 05:15 vuln.today

DescriptionCVE.org

The /api/v1/autotranslate.translateMessage endpoint in versions <8.5.0, <8.4.2, <8.3.4, <8.2.4, <8.1.5, <8.0.6, <7.13.8, and <7.10.12 allows any authenticated user to retrieve the full content of any message from any room (private groups, direct messages, channels) by simply providing the target message ID. The endpoint fetches the message via Messages.findOneById(messageId) with no room access check (canAccessRoomIdAsync is never called), returning the complete IMessage object including message text, sender info, room ID, timestamps, and markdown content.

AnalysisAI

Broken access control on the /api/v1/autotranslate.translateMessage endpoint in Rocket.Chat allows any authenticated user to retrieve the full content of messages from rooms they have no membership in - including private groups, direct messages, and channels - by supplying only a valid message ID. The vulnerability stems from the complete absence of a room-level authorization check (canAccessRoomIdAsync is never invoked) before the message fetch via Messages.findOneById(). No public exploit code or CISA KEV listing has been identified at time of analysis, but the high confidentiality impact (C:H in CVSS) means successful exploitation exposes sensitive private communications organization-wide.

Technical ContextAI

The affected endpoint is a server-side REST API route in Rocket.Chat's autotranslate feature (CPE: cpe:2.3:a:rocket.chat:rocket.chat:*). When a translation request is submitted, the handler calls Messages.findOneById(messageId) to resolve the target message, but the standard room-access gate - canAccessRoomIdAsync - is never invoked. This is a textbook CWE-284 (Improper Access Control) instance: the application correctly authenticates the calling user but fails to enforce the authorization rule that restricts message visibility to room members. The returned IMessage object includes message text, sender identity, room ID, timestamps, and rendered markdown - the full data model - making this a complete confidentiality bypass rather than a partial information leak.

RemediationAI

Upgrade to the earliest fixed release in your respective version branch: 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, or 7.10.12. These version thresholds are derived directly from the CVE description's affected-version ranges; a patched release at each boundary is implied, but independent confirmation of fix-version release notes was not available in the provided data - verify against the Rocket.Chat changelog or HackerOne report at https://hackerone.com/reports/3713682. If immediate upgrade is not possible, a compensating control is to disable or restrict access to the /api/v1/autotranslate.translateMessage endpoint at the reverse-proxy or API gateway layer; note that this will break the autotranslate feature for all users. Additionally, auditing API access logs for calls to this endpoint from users outside of expected room memberships may help detect prior exploitation. Restricting user registration and revoking unused internal accounts reduces the PR:L attack surface while a patch is applied.