CVE-2026-29197

Published: Apr 24, 2026Modified: Jun 17, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

In versions <8.4.0, <8.3.2, <8.2.2, <8.1.3, <8.0.4, <7.13.6, <7.12.7, <7.11.7, and <7.10.10, the endpoints /api/apps/logs and /api/apps/:id/logs have a typo in the required permission check, allowing authenticated users without the proper permissions to read apps-engine logs.

Affected (8)

Products: Rocket.chat: Rocket.chat

Rocket.chat

1 product

Rocket.chat

Configuration A

8 vulnerable

Vulnerable Software	Affected Versions
Rocket.chat Rocket.chat	7.10.0 ≤ version < 7.10.10
Rocket.chat Rocket.chat	7.11.0 ≤ version < 7.11.7
Rocket.chat Rocket.chat	7.12.0 ≤ version < 7.12.7
Rocket.chat Rocket.chat	7.13.0 ≤ version < 7.13.6
Rocket.chat Rocket.chat	8.0.0 ≤ version < 8.0.4
Rocket.chat Rocket.chat	8.1.0 ≤ version < 8.1.3
Rocket.chat Rocket.chat	8.2.0 ≤ version < 8.2.2
Rocket.chat Rocket.chat	8.3.0 ≤ version < 8.3.2

Related CWEs

CWE-284

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

References (2)

https://github.com/RocketChat/Rocket.Chat/pull/40125

Source: support@hackerone.com

Issue TrackingPatch

https://hackerone.com/reports/3589551

Source: support@hackerone.com

Third Party Advisory

Timeline

No history available yet.