CVE-2026-45687

{
  "id": "CVE-2026-45687",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-24T21:16:53.720",
  "lastModified": "2026-10-25T22:10:00.150",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11, Rocket.Chat's sendFileMessage DDP method passes the entire attacker-supplied file object into Uploads.updateFileComplete, which merges it directly into a MongoDB $set update via Object.assign. There is no allow-list of writable fields. An attacker can therefore rewrite any column on their own upload record, notably store and the store-specific path fields. This vulnerability is fixed in 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11."
    },
    {
      "lang": "es",
      "value": "Rocket.Chat es una plataforma de comunicaciones de código abierto, segura y totalmente personalizable. Antes de las versiones 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7 y 7.10.11, el método DDP sendFileMessage de Rocket.Chat pasa el objeto de archivo completo proporcionado por el atacante a Uploads.updateFileComplete, que lo fusiona directamente en una actualización $set de MongoDB a través de Object.assign. No existe una lista de permitidos de campos escribibles. Un atacante puede, por lo tanto, reescribir cualquier columna en su propio registro de carga, notablemente los campos ’store’ y los campos de ruta específicos de ’store’. Esta vulnerabilidad se corrige en las versiones 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7 y 7.10.11."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "RocketChat",
          "product": "Rocket.Chat",
          "versions": [
            {
              "version": ">= 8.5.0-rc.0, < 8.5.0",
              "status": "affected"
            },
            {
              "version": ">= 8.4.0-rc.0, < 8.4.1",
              "status": "affected"
            },
            {
              "version": ">= 8.3.0-rc.0, < 8.3.3",
              "status": "affected"
            },
            {
              "version": ">= 8.2.0-rc.0, < 8.2.3",
              "status": "affected"
            },
            {
              "version": ">= 8.1.0-rc.0, < 8.1.4",
              "status": "affected"
            },
            {
              "version": ">= 8.0.0-rc.0, < 8.0.5",
              "status": "affected"
            },
            {
              "version": ">= 7.11.0-rc.0, < 7.13.7",
              "status": "affected"
            },
            {
              "version": "< 7.10.11",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
          "baseScore": 8.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 4.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-26T17:51:10.359261Z",
          "id": "CVE-2026-45687",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-915"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-fhc2-x8cp-c5ch",
      "source": "[email protected]"
    }
  ]
}