← Back

CVE-2025-7974

nvd nist
Published: Sep 2, 2025Modified: Jun 17, 2026

JSON object

Loading...
7.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Exploitability: 3.9 / Impact: 3.6
Source: NVD

Description

rocket.chat Incorrect Authorization Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of rocket.chat. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP port 3000 by default. The issue results from incorrect authorization. An attacker can leverage this vulnerability to disclose information in the context of the application. Was ZDI-CAN-26517.

Affected (5)

Rocket.chat
1 product
Rocket.chat
Configuration A
5 vulnerable
Vulnerable SoftwareAffected Versions
Rocket.chat
Rocket.chat
After 7.7.2 to 7.8.0
Rocket.chat
From 7.4.0 to 7.4.4
Rocket.chat
From 7.5.0 to 7.5.3
Rocket.chat
From 7.6.0 to 7.6.4
Rocket.chat
From 7.7.0 to 7.7.2

Related CWEs

CWE-863
Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (1)

Source: zdi-disclosures@trendmicro.com
Third Party Advisory

Timeline

No history available yet.