CVE-2026-48929
Full vulnerability record from the local CVENow database.
Description
Rocket.Chat in versions <8.5.1, <8.4.4, <8.3.6, <8.2.6, <8.1.6, <8.0.7, <7.13.9, and <7.10.13 is vulnerable to unauthenticated file deletion. The deleteFileMessage Meteor method permanently deletes any uploaded file by ID without requiring authentication. When called via an unauthenticated DDP WebSocket connection, Meteor.userId() returns null, causing the authorization check to be skipped. Execution falls through to FileUpload.getStore('Uploads').deleteById(fileID), which removes the file from storage and database unconditionally. File IDs are discoverable from public channel message payloads and download URLs.
Severity
HIGH
CVSS score
7.5
(v3.0)
Vulnerability status
Analyzed
Source identifier
Published
2026-06-17 13:20:44.550000
Last modified
2026-10-24 13:10:00.147000
View original CVE JSON
{
"id": "CVE-2026-48929",
"sourceIdentifier": "[email protected]",
"published": "2026-06-17T13:20:44.550",
"lastModified": "2026-10-24T13:10:00.147",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Rocket.Chat in versions <8.5.1, <8.4.4, <8.3.6, <8.2.6, <8.1.6, <8.0.7, <7.13.9, and <7.10.13 is vulnerable to unauthenticated file deletion. The deleteFileMessage Meteor method permanently deletes any uploaded file by ID without requiring authentication. When called via an unauthenticated DDP WebSocket connection, Meteor.userId() returns null, causing the authorization check to be skipped. Execution falls through to FileUpload.getStore('Uploads').deleteById(fileID), which removes the file from storage and database unconditionally. File IDs are discoverable from public channel message payloads and download URLs."
},
{
"lang": "es",
"value": "Rocket.Chat en versiones anteriores a 8.5.1, anterior a 8.4.4, anterior a 8.3.6, anterior a 8.2.6, anterior a 8.1.6, anterior a 8.0.7, anterior a 7.13.9 y anterior a 7.10.13 es vulnerable a la eliminación de archivos no autenticada. El método Meteor deleteFileMessage elimina permanentemente cualquier archivo subido por ID sin requerir autenticación. Cuando se llama a través de una conexión DDP WebSocket no autenticada, Meteor.userId() devuelve null, causando que la verificación de autorización sea omitida. La ejecución pasa a FileUpload.getStore('Uploads').deleteById(fileID), que elimina el archivo del almacenamiento y la base de datos incondicionalmente. Los ID de archivo son descubribles a partir de las cargas útiles de mensajes de canales públicos y las URL de descarga."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Rocket.Chat",
"product": "Rocket.Chat",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThan": "8.5.1",
"versionType": "semver",
"status": "affected"
},
{
"version": "0",
"lessThan": "8.4.4",
"versionType": "semver",
"status": "affected"
},
{
"version": "0",
"lessThan": "8.3.6",
"versionType": "semver",
"status": "affected"
},
{
"version": "0",
"lessThan": "8.2.6",
"versionType": "semver",
"status": "affected"
},
{
"version": "0",
"lessThan": "8.1.6",
"versionType": "semver",
"status": "affected"
},
{
"version": "0",
"lessThan": "8.0.7",
"versionType": "semver",
"status": "affected"
},
{
"version": "0",
"lessThan": "7.13.9",
"versionType": "semver",
"status": "affected"
},
{
"version": "0",
"lessThan": "7.10.13",
"versionType": "semver",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV30": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.0",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-06-17T15:02:38.629156Z",
"id": "CVE-2026-48929",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-287"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.10.13",
"matchCriteriaId": "848AE1B8-5E16-4848-8C1B-51EF8676EDE5"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:*",
"versionStartIncluding": "7.13.0",
"versionEndExcluding": "7.13.9",
"matchCriteriaId": "433D60B1-F51D-4F4C-8628-332A27CC7009"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:*",
"versionStartIncluding": "8.0.0",
"versionEndExcluding": "8.0.7",
"matchCriteriaId": "1D9D3B12-AE81-4FBD-AD25-5F97380FBA5B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:*",
"versionStartIncluding": "8.1.0",
"versionEndExcluding": "8.1.6",
"matchCriteriaId": "0803F4B6-31AA-476F-831C-71DBF8A48F2D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:*",
"versionStartIncluding": "8.2.0",
"versionEndExcluding": "8.2.6",
"matchCriteriaId": "B013E425-EA3E-4802-838D-04DAC0CC8BF2"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:*",
"versionStartIncluding": "8.3.0",
"versionEndExcluding": "8.3.6",
"matchCriteriaId": "BF7B1B1C-AE07-4658-901E-0F412B0E3E31"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:*",
"versionStartIncluding": "8.4.0",
"versionEndExcluding": "8.4.4",
"matchCriteriaId": "932324CF-CA75-42AE-A449-B9B3726EC187"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:*",
"versionStartIncluding": "8.5.0",
"versionEndExcluding": "8.5.1",
"matchCriteriaId": "9DD0F18A-6E6E-4BEF-B72F-ED1A23E9BA66"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/RocketChat/Rocket.Chat/pull/40889/",
"source": "[email protected]",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
]
},
{
"url": "https://hackerone.com/reports/3611837",
"source": "[email protected]",
"tags": [
"Third Party Advisory"
]
}
]
}