EUVD-2026-55846Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Network-reachable WebSocket requires only low-privilege credentials (PR:L), victim must actively have chat open (UI:R), scope changes to affect victim session with low confidentiality and integrity impact and no availability impact.
Primary rating from Vendor (github).
CVSS VectorVendor: github
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1, the stream-notify-user stream in the WebSocket protocol allows an authenticated user to write arbitrary notification bodies because the sender is not checked, and the client-side UI can create an ephemeral fake message in another user's currently open chat. This issue is fixed in versions 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1.
AnalysisAI
Rocket.Chat's WebSocket stream-notify-user mechanism lacks sender verification, enabling any authenticated user to inject arbitrary notification bodies into another user's active chat session. Affected versions span multiple release branches prior to 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold a valid authenticated session on the target Rocket.Chat instance; any registered user account suffices, and administrator privileges are not required (CVSS PR:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N yields a medium score of 5.4, which appropriately reflects that exploitation requires authentication (PR:L) and a victim with a chat window actively open (UI:R). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated Rocket.Chat user connects via WebSocket and sends a crafted stream-notify-user event addressed to a target user, populating the notification body with an arbitrary message impersonating a system alert or a trusted colleague's communication. The victim, who currently has the relevant chat window open, sees the fake ephemeral message rendered in their UI and may act on it - clicking a fabricated link, disclosing credentials, or approving a spoofed request. … |
| Remediation | Upgrade Rocket.Chat to the patched release corresponding to your deployed branch: 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, or 8.6.1, as documented in the vendor advisory at https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-27jx-236m-3f5j. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today