What is the CVSS score of EUVD-2026-39121?

EUVD-2026-39121 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Rocket.Chat are affected by EUVD-2026-39121?

CVE-2026-55762 is a high-severity authorization bypass in workspace deployment operations that allows authenticated users to delete cloud credentials, revoke workspace licenses, and disable push…. A patch is available.

How to fix or mitigate EUVD-2026-39121?

Within 24 hours: Restrict network access to the affected deployment endpoint to administrative IP ranges only via firewall or API gateway; audit workspace modification logs for unauthorized changes in the past 30 days; reset cloud workspace credentials as a precaution. Within 7 days: Implement additional role-based authorization checks at the application layer if vendor controls are insufficient; enable detailed audit logging and real-time alerting for all deployment API calls; document current RBAC policies and gaps. Within 30 days: Monitor vendor security advisories for patch availability; prepare and test patch deployment; assess architectural controls for privilege enforcement and plan remediation timeline upon patch release.

Rocket.Chat EUVD-2026-39121

| CVE-2026-55762 HIGH

Missing Authorization (CWE-862)

2026-06-24 GitHub_M

Authentication Bypass Rocket Chat

8.1

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

vuln.today AI

8.1 HIGH

Any authenticated low-privilege user can call a network endpoint with no UI (PR:L, AV:N, AC:L, UI:N); destructive deregistration harms integrity and availability but exposes no data, so C:N, I:H, A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 24, 2026 - 23:03 EUVD

Analysis Generated

Jun 24, 2026 - 22:15 vuln.today

DescriptionCVE.org

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13, the POST /api/v1/fingerprint REST endpoint enforces authentication (authRequired: true) but performs no authorization check. Any authenticated user - including a standard user role account - can call this endpoint with {"setDeploymentAs": "new-workspace"} to permanently deregister the workspace from Rocket.Chat Cloud. This wipes all cloud credentials, removes the workspace license, breaks push notifications for all users, and requires manual re-registration to recover. This vulnerability is fixed in 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13.

AnalysisAI

{"setDeploymentAs": "new-workspace"}. The endpoint correctly requires authentication but performs no role/permission check (CWE-862), so the action wipes cloud credentials, removes the workspace license, and breaks push notifications for all users until manual re-registration. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Obtain standard authenticated account

Delivery

Authenticate to get session token

Exploit

POST /api/v1/fingerprint setDeploymentAs new-workspace

Execution

Server skips authorization check

Impact

Workspace deregistered, license and push wiped