Rocket.Chat vulnerabilities

CVEs per yearBy the year they were published

1. 20243
2. 20252
3. 202611

Newest CVEs

• CVE-2026-65644

  Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, and 7.10.15 has a REST API endpoint POST /api/v1/livechat/visitor that…

  Rocket.Chat · Rocket.Chat

  High7.5
• CVE-2026-65645

  Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6. 8.3.8, 8.2.8, 8.1.8, and 7.10.15, the Meteor DDP methods getThreadsList and getThreadMessages…

  Rocket.Chat · Rocket.Chat

  Medium4.3
• CVE-2026-56845

  An unauthenticated path traversal (LFI) vulnerability exists under /custom-sounds/ when CustomSounds storage is configured to FileSystem. By including ../…

  Rocket.Chat · Rocket.Chat

  High7.5
• CVE-2026-58066

  Rocket.Chat's SAML SSO before versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8, and 7.10.14 verified XML signatures but did not bind the…

  Rocket.Chat · Rocket.Chat

  Critical9.8
• CVE-2026-48616

  Rocket.Chat versions <8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, 7.13.9, 7.10.13 has an access control vulnerability in Livechat files. Protected file downloads…

  Rocket.Chat · Rocket.Chat

  Critical9.3
• CVE-2026-48929

  Rocket.Chat in versions <8.5.1, <8.4.4, <8.3.6, <8.2.6, <8.1.6, <8.0.7, <7.13.9, and <7.10.13 is vulnerable to unauthenticated file deletion. The…

  Rocket.Chat · Rocket.Chat

  High7.5
• CVE-2026-32995

  The Rocket.Chat DDP method autoTranslate.translateMessage in versions <8.5.0, <8.4.2, <8.3.4, <8.2.4, <8.1.5, <8.0.5, <7.13.8, and <7.10.12 accepts a…

  Rocket.Chat · Rocket.Chat

  High7.5
• CVE-2026-32994

  The /api/v1/autotranslate.translateMessage endpoint in versions <8.5.0, <8.4.2, <8.3.4, <8.2.4, <8.1.5, <8.0.6, <7.13.8, and <7.10.12 allows any authenticated…

  Rocket.Chat · Rocket.Chat

  Medium5.3
• CVE-2026-29197

  In versions <8.4.0, <8.3.2, <8.2.2, <8.1.3, <8.0.4, <7.13.6, <7.12.7, <7.11.7, and <7.10.10, the endpoints /api/apps/logs and /api/apps/:id/logs have a typo in…

  Rocket.Chat · Rocket.Chat

  Medium4.3
• CVE-2026-29198

  In Rocket.Chat <8.3.0, <8.2.1, <8.1.2, <8.0.3, <7.13.5, <7.12.6, <7.11.6, and <7.10.9, a NoSQL injection vulnerability can lead to account takeover of the…

  Rocket.Chat · Rocket.Chat

  Critical9.8