EUVD-2026-55847Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Network-reachable REST API requires a valid session with create-team permission (PR:L); impact is limited to channel-structure integrity modification with no data disclosure or availability loss.
Primary rating from Vendor (github).
CVSS VectorVendor: github
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
3DescriptionCVE.org
Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1, the channels.convertToTeam REST endpoint allows an authenticated registered user with the create-team permission to convert an unrelated public channel by supplying channelName instead of channelId because the edit-room permission is checked only for channelId. This issue is fixed in versions 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1.
AnalysisAI
Authorization bypass in Rocket.Chat's channels.convertToTeam REST endpoint allows any authenticated user holding the create-team permission to convert public channels they do not own or moderate into teams, circumventing the edit-room permission check entirely. Affected are all Rocket.Chat server deployments prior to versions 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must be an authenticated Rocket.Chat user with the create-team permission explicitly granted to their role - this permission is configurable by administrators and is not universally assigned to all registered users by default. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 4.3 (Medium, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) accurately characterizes a narrow-scope integrity impact with no confidentiality or availability consequence. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated Rocket.Chat user with the create-team permission crafts a POST request to the /api/v1/channels.convertToTeam endpoint, supplying channelName of a public channel they have no ownership or moderation rights over. Because the server's pre-fix code skips the edit-room authorization check when channelName is used instead of channelId, the conversion succeeds and the channel is restructured as a team, effectively granting the attacker administrative influence over channel they did not own. … |
| Remediation | Upgrade to Rocket.Chat version 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, or 8.6.1 depending on your active release branch - these are the confirmed fixed versions per the GitHub security advisory at https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-4mvx-9h2h-hmg3 and commit 175a19c4151f41910499ef37df54f58022276d12. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today