RocketChat Rocket.Chat vulnerabilities

CVEs per yearBy the year they were published

1. 20211
2. 202619

Newest CVEs

• CVE-2026-75575

  Rocket.Chat Missing DDP Rate Limit on the sendForgotPasswordEmail Meteor Method

  RocketChat · Rocket.Chat

  Medium6.9
• CVE-2026-72919

  Rocket.Chat: Broken Access Control in channels.convertToTeam Allows Unauthorized Conversion of Public Channels into Teams

  RocketChat · Rocket.Chat

  Medium4.3
• CVE-2026-72918

  Rocket.Chat: Insecure implementation of websocket notifications

  RocketChat · Rocket.Chat

  Medium5.4
• CVE-2026-55762

  Rocket.Chat: Any Authenticated User Can Permanently Deregister Workspace from Rocket.Chat Cloud via Unprotected `/api/v1/fingerprint` Endpoint

  RocketChat · Rocket.Chat

  High8.1
• CVE-2026-55759

  Rocket.Chat: Apple Sign-In skips JWT claims validation, allowing expired and cross-audience token replay

  RocketChat · Rocket.Chat

  High7.4
• CVE-2026-55666

  Rocket.Chat: Email Parameter Fallback Leads To Account Takeover Within Apple OAuth

  RocketChat · Rocket.Chat

  Critical9.3
• CVE-2026-49278

  Rocket.Chat: Livechat Visitor Profile Disclosure Leaks Bearer Token and Enables Visitor Impersonation

  RocketChat · Rocket.Chat

  Medium6.7
• CVE-2026-49277

  Rocket.Chat: OAuth access and refresh tokens remain valid after account deactivation

  RocketChat · Rocket.Chat

  Low2.3
• CVE-2026-45757

  Rocket.Chat: users.deactivateIdle` deactivates accounts without revoking existing login tokens

  RocketChat · Rocket.Chat

  Low2.3
• CVE-2026-46423

  Rocket.Chat: SAML signature validation skipped when IdP certificate field is empty

  RocketChat · Rocket.Chat

  Critical9.3