CVE-2026-48616

Published: Jun 17, 2026Modified: Jun 18, 2026

9.3

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

Exploitability: 3.9 / Impact: 4.7

Source: support@hackerone.com (Secondary)

Description

Rocket.Chat versions <8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, 7.13.9, 7.10.13 has an access control vulnerability in Livechat files. Protected file downloads at /file-upload/:fileId/:name authorize livechat access using rc_room_type=l with rc_rid+rc_token, but the authorization path does not verify that rc_rid matches the requested file's rid. Furthermore, :fileId is predictable via sequential MongoDB IDs, and :name can be anything, allowing unauthenticated discovery of all uploaded files.

Affected (8)

Products: Rocket.chat: Rocket.chat

Rocket.chat

1 product

Rocket.chat

Configuration A

8 vulnerable

Vulnerable Software	Affected Versions
Rocket.chat Rocket.chat	Before 7.10.13
Rocket.chat Rocket.chat	From 7.13.0 to 7.13.9
Rocket.chat Rocket.chat	From 8.0.0 to 8.0.7
Rocket.chat Rocket.chat	From 8.1.0 to 8.1.6
Rocket.chat Rocket.chat	From 8.2.0 to 8.2.6
Rocket.chat Rocket.chat	From 8.3.0 to 8.3.6
Rocket.chat Rocket.chat	From 8.4.0 to 8.4.4
Rocket.chat Rocket.chat	From 8.5.0 to 8.5.1

Related CWEs

CWE-284

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

References (2)

https://github.com/RocketChat/Rocket.Chat/pull/40889

Source: support@hackerone.com

Issue TrackingPatchThird Party Advisory

https://hackerone.com/reports/3687142

Source: support@hackerone.com

Third Party Advisory

Timeline

No history available yet.