Rocketchat
Monthly
Unauthorized workspace deregistration in Rocket.Chat versions prior to fixed releases allows any authenticated user to permanently disconnect the workspace from Rocket.Chat Cloud. The vulnerability stems from missing authorization checks on the /api/v1/fingerprint REST endpoint, enabling low-privilege users to wipe cloud credentials, remove licenses, and break push notifications for all users. No active exploitation or public exploit code has been identified, and the EPSS score indicates low exploitation probability despite a high CVSS severity.
Authentication bypass in Rocket.Chat's Apple Sign-In handler allows attackers to impersonate any user by replaying a captured Apple identity token. The handler verifies the JWT signature but skips validation of the aud, exp, nbf, and nonce claims, so any Apple-signed token with a non-empty iss is accepted indefinitely with no replay-window expiry. Affected versions are those prior to 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Authentication bypass leading to account takeover in Rocket.Chat affects the Apple Sign-In OAuth flow prior to versions 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13. The handleIdentityToken function in the Apple login handler falls back to trusting an attacker-supplied email value when the Apple-issued JWT omits an email claim, so a remote unauthenticated attacker can forge an email-less Apple JWT and log in as any victim by their email address. No public exploit is identified at time of analysis, but the CVSS 4.0 base score of 9.3 (critical) and trivial exploitation conditions make this a high priority for any instance with Apple login enabled.
Rocket.Chat's unauthenticated DDP method sendForgotPasswordEmail lacks a rate-limiting rule, enabling any network caller to flood a target email address with password reset messages from the deployment's own mail sender and to enumerate account types at scale. The method is reachable both via the Meteor DDP protocol and the unauthenticated HTTP route POST /api/v1/method.callAnon/sendForgotPasswordEmail, requiring no credentials. A side-channel in the method's response - returning false only when the target belongs to an OAuth-authenticated account with Accounts_AllowPasswordChangeForOAuthUsers disabled - allows an attacker to distinguish account authentication types, confirming information disclosure beyond simple email abuse. No public exploit or KEV listing is identified at time of analysis.
Rocket.Chat version 0.8.0 and newer is vulnerable to XSS in the markdown link parsing code for messages. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Unauthorized workspace deregistration in Rocket.Chat versions prior to fixed releases allows any authenticated user to permanently disconnect the workspace from Rocket.Chat Cloud. The vulnerability stems from missing authorization checks on the /api/v1/fingerprint REST endpoint, enabling low-privilege users to wipe cloud credentials, remove licenses, and break push notifications for all users. No active exploitation or public exploit code has been identified, and the EPSS score indicates low exploitation probability despite a high CVSS severity.
Authentication bypass in Rocket.Chat's Apple Sign-In handler allows attackers to impersonate any user by replaying a captured Apple identity token. The handler verifies the JWT signature but skips validation of the aud, exp, nbf, and nonce claims, so any Apple-signed token with a non-empty iss is accepted indefinitely with no replay-window expiry. Affected versions are those prior to 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Authentication bypass leading to account takeover in Rocket.Chat affects the Apple Sign-In OAuth flow prior to versions 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13. The handleIdentityToken function in the Apple login handler falls back to trusting an attacker-supplied email value when the Apple-issued JWT omits an email claim, so a remote unauthenticated attacker can forge an email-less Apple JWT and log in as any victim by their email address. No public exploit is identified at time of analysis, but the CVSS 4.0 base score of 9.3 (critical) and trivial exploitation conditions make this a high priority for any instance with Apple login enabled.
Rocket.Chat's unauthenticated DDP method sendForgotPasswordEmail lacks a rate-limiting rule, enabling any network caller to flood a target email address with password reset messages from the deployment's own mail sender and to enumerate account types at scale. The method is reachable both via the Meteor DDP protocol and the unauthenticated HTTP route POST /api/v1/method.callAnon/sendForgotPasswordEmail, requiring no credentials. A side-channel in the method's response - returning false only when the target belongs to an OAuth-authenticated account with Accounts_AllowPasswordChangeForOAuthUsers disabled - allows an attacker to distinguish account authentication types, confirming information disclosure beyond simple email abuse. No public exploit or KEV listing is identified at time of analysis.
Rocket.Chat version 0.8.0 and newer is vulnerable to XSS in the markdown link parsing code for messages. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.