CVE-2026-72918

{
  "id": "CVE-2026-72918",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-10T22:17:10.807",
  "lastModified": "2026-10-24T15:10:00.190",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1, the stream-notify-user stream in the WebSocket protocol allows an authenticated user to write arbitrary notification bodies because the sender is not checked, and the client-side UI can create an ephemeral fake message in another user's currently open chat. This issue is fixed in versions 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1."
    },
    {
      "lang": "es",
      "value": "Rocket.Chat es una plataforma de comunicaciones de código abierto, segura y totalmente personalizable. Antes de las versiones 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2 y 8.6.1, la transmisión stream-notify-user en el protocolo WebSocket permite a un usuario autenticado escribir cuerpos de notificación arbitrarios porque el remitente no es verificado, y la interfaz de usuario del lado del cliente puede crear un mensaje falso efímero en el chat actualmente abierto de otro usuario. Este problema está solucionado en las versiones 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2 y 8.6.1."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "RocketChat",
          "product": "Rocket.Chat",
          "versions": [
            {
              "version": "< 7.10.14",
              "status": "affected"
            },
            {
              "version": ">= 8.0.0, < 8.0.8",
              "status": "affected"
            },
            {
              "version": ">= 8.1.0, < 8.1.7",
              "status": "affected"
            },
            {
              "version": ">= 8.2.0, < 8.2.7",
              "status": "affected"
            },
            {
              "version": ">= 8.3.0, < 8.3.7",
              "status": "affected"
            },
            {
              "version": ">= 8.4.0, < 8.4.5",
              "status": "affected"
            },
            {
              "version": ">= 8.5.0, < 8.5.2",
              "status": "affected"
            },
            {
              "version": ">= 8.6.0, < 8.6.1",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 2.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-11T16:04:20.390453Z",
          "id": "CVE-2026-72918",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-27jx-236m-3f5j",
      "source": "[email protected]"
    }
  ]
}