CVE-2026-29197

Published: Apr 24, 2026Modified: Jun 17, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

In versions <8.4.0, <8.3.2, <8.2.2, <8.1.3, <8.0.4, <7.13.6, <7.12.7, <7.11.7, and <7.10.10, the endpoints /api/apps/logs and /api/apps/:id/logs have a typo in the required permission check, allowing authenticated users without the proper permissions to read apps-engine logs.

Affected (8)

Products: Rocket.chat: Rocket.chat

Rocket.chat

1 product

Rocket.chat

Configuration A

8 vulnerable

Vulnerable Software	Affected Versions
Rocket.chat Rocket.chat	From 7.10.0 to 7.10.10
Rocket.chat Rocket.chat	From 7.11.0 to 7.11.7
Rocket.chat Rocket.chat	From 7.12.0 to 7.12.7
Rocket.chat Rocket.chat	From 7.13.0 to 7.13.6
Rocket.chat Rocket.chat	From 8.0.0 to 8.0.4
Rocket.chat Rocket.chat	From 8.1.0 to 8.1.3
Rocket.chat Rocket.chat	From 8.2.0 to 8.2.2
Rocket.chat Rocket.chat	From 8.3.0 to 8.3.2

Related CWEs

CWE-284

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

References (2)

https://github.com/RocketChat/Rocket.Chat/pull/40125

Source: support@hackerone.com

Issue TrackingPatch

https://hackerone.com/reports/3589551

Source: support@hackerone.com

Third Party Advisory

Timeline

No history available yet.