CVE-2026-65645
Full vulnerability record from the local CVENow database.
Description
Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6. 8.3.8, 8.2.8, 8.1.8, and 7.10.15, the Meteor DDP methods getThreadsList and getThreadMessages accept rid / tmid as raw, untyped parameters with no schema validation. A MongoDB operator object (e.g. {"$gt": "4"}) can be substituted for a string room-id or message-id. The authorization check resolves to a room the attacker already has access to, while the downstream data query fans out across all rooms - disclosing private thread parents and their full reply content to any low-privilege authenticated user. The REST route chat.getThreadsList was patched in v5.0 (HackerOne report #1446767) by adding rid: {type:'string'} AJV validation. The equivalent DDP method was never given the same fix and remains exploitable
Severity
MEDIUM
CVSS score
4.3
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2026-08-21 04:18:14.690000
Last modified
2026-10-26 10:10:00.140000
View original CVE JSON
{
"id": "CVE-2026-65645",
"sourceIdentifier": "[email protected]",
"published": "2026-08-21T04:18:14.690",
"lastModified": "2026-10-26T10:10:00.140",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6. 8.3.8, 8.2.8, 8.1.8, and 7.10.15, the Meteor DDP methods getThreadsList and getThreadMessages accept rid / tmid as raw, untyped parameters with no schema validation. A MongoDB operator object (e.g. {\"$gt\": \"4\"}) can be substituted for a string room-id or message-id. The authorization check resolves to a room the attacker already has access to, while the downstream data query fans out across all rooms - disclosing private thread parents and their full reply content to any low-privilege authenticated user.\nThe REST route chat.getThreadsList was patched in v5.0 (HackerOne report #1446767) by adding rid: {type:'string'} AJV validation. The equivalent DDP method was never given the same fix and remains exploitable"
},
{
"lang": "es",
"value": "Rocket.Chat en versiones anteriores a 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8 y 7.10.15, los métodos DDP de Meteor getThreadsList y getThreadMessages aceptan rid / tmid como parámetros sin procesar, sin tipo y sin validación de esquema. Un objeto operador de MongoDB (por ejemplo, {’$gt’: ’4’}) puede sustituirse por un room-id o message-id de tipo cadena. La comprobación de autorización se resuelve en una sala a la que el atacante ya tiene acceso, mientras que la consulta de datos posterior se extiende por todas las salas, revelando los padres de hilos privados y su contenido completo de respuesta a cualquier usuario autenticado con bajos privilegios. La ruta REST chat.getThreadsList fue parcheada en la v5.0 (informe de HackerOne #1446767) añadiendo la validación AJV rid: {type:’string’}. El método DDP equivalente nunca recibió la misma corrección y sigue siendo explotable."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Rocket.Chat",
"product": "Rocket.Chat",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThan": "8.8.0",
"versionType": "semver",
"status": "affected"
},
{
"version": "0",
"lessThan": "8.7.1",
"versionType": "semver",
"status": "affected"
},
{
"version": "0",
"lessThan": "8.6.2",
"versionType": "semver",
"status": "affected"
},
{
"version": "0",
"lessThan": "8.5.3",
"versionType": "semver",
"status": "affected"
},
{
"version": "0",
"lessThan": "8.4.6",
"versionType": "semver",
"status": "affected"
},
{
"version": "0",
"lessThan": "8.3.8",
"versionType": "semver",
"status": "affected"
},
{
"version": "0",
"lessThan": "8.2.8",
"versionType": "semver",
"status": "affected"
},
{
"version": "0",
"lessThan": "8.1.8",
"versionType": "semver",
"status": "affected"
},
{
"version": "0",
"lessThan": "7.10.15",
"versionType": "semver",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-08-27T17:46:23.910812Z",
"id": "CVE-2026-65645",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-20"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.10.15",
"matchCriteriaId": "83AFD920-8EAC-445A-9EDE-39A405C7EFCF"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:*",
"versionStartIncluding": "8.1.0",
"versionEndExcluding": "8.1.8",
"matchCriteriaId": "F0047835-D014-4735-9D38-AD6E91E69DC2"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:*",
"versionStartIncluding": "8.2.0",
"versionEndExcluding": "8.2.8",
"matchCriteriaId": "7BF9BDAA-1A56-43C5-ACFC-4849A21CD601"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:*",
"versionStartIncluding": "8.3.0",
"versionEndExcluding": "8.3.8",
"matchCriteriaId": "36B7912B-900A-4B96-BAE2-9CA5834BB25A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:*",
"versionStartIncluding": "8.4.0",
"versionEndExcluding": "8.4.6",
"matchCriteriaId": "5314C8E0-FBBB-4DB6-9729-D6A41DEE57AF"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:*",
"versionStartIncluding": "8.5.0",
"versionEndExcluding": "8.5.3",
"matchCriteriaId": "4E8FA572-5D43-4253-A81E-F0F4FC3F3189"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:*",
"versionStartIncluding": "8.6.0",
"versionEndExcluding": "8.6.2",
"matchCriteriaId": "773C4B37-A14E-4898-8501-3F89C796CFC1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:rocket.chat:rocket.chat:8.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "89603D12-AAF4-4065-BDE9-45EB52E29EE0"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/RocketChat/Rocket.Chat/pull/41814",
"source": "[email protected]",
"tags": [
"Patch",
"Vendor Advisory"
]
},
{
"url": "https://hackerone.com/reports/3852135",
"source": "[email protected]",
"tags": [
"Third Party Advisory",
"Issue Tracking"
]
}
]
}