Rocket.Chat EUVD-2026-65218

No authentication is required; the method is exposed via the anonymous HTTP bridge at POST /api/v1/method.callAnon/sendForgotPasswordEmail and via unauthenticated DDP, both accessible from any network that can reach the Rocket.Chat server. The email-flooding path has no special configuration prerequisite and works against default deployments. The account-type enumeration side-channel is conditional: it reveals OAuth-only accounts only when the server-side setting Accounts_AllowPasswordChangeForOAuthUsers is set to false (non-default hardening); in default or permissive configurations, the method returns true for all existing accounts and the enumeration signal is absent. Exploitation is limited to flooding or probing - no session hijack or code execution is possible through this vector alone.

The CVSS 4.0 score of 6.9 with vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N reflects two distinct but moderate impacts: low confidentiality loss from account-type enumeration and unbounded mail abuse, with no integrity or availability impact assessed against the Rocket.Chat system itself. The attack complexity is genuinely low - the HTTP anonymous route requires no special tooling or protocol knowledge beyond a standard HTTP client. The confidentiality signal (VC:L) is accurate: an attacker learns only whether an address maps to an OAuth-only account when AllowPasswordChangeForOAuthUsers is off, which is useful for targeted follow-on phishing but not a full account takeover path. No EPSS data was provided, and there is no CISA KEV listing, indicating no confirmed broad exploitation. The real-world risk is primarily reputational and operational - mass reset mail from a Rocket.Chat server damages mail sender reputation and can trigger spam-list blocklisting - rather than direct system compromise. The information disclosure component adds modest targeted-attack value. This is a real priority for operators concerned about mail abuse or user enumeration, but not an emergency patch for organizations without external mail exposure.

An unauthenticated attacker sends repeated HTTP POST requests to https://target.rocketchat.example/api/v1/method.callAnon/sendForgotPasswordEmail with a victim's email address in the body, driving the server to dispatch hundreds of password reset emails per minute from its configured mail sender. In a parallel enumeration pass, the attacker submits a list of candidate email addresses and identifies OAuth-only accounts by observing false responses - narrowing a target list for credential stuffing or spear-phishing against those users' OAuth identity providers. No exploit code is publicly available; a standard HTTP client and a list of candidate addresses are sufficient to exercise both attack paths.