Unknown · Rocket.Chat · CVE-2026-65645
**Name of the Vulnerable Software and Affected Versions**
Rocket.Chat versions prior to 8.8.0
Rocket.Chat versions prior to 8.7.1
Rocket.Chat versions prior to 8.6.2
Rocket.Chat versions prior to 8.5.3
Rocket.Chat versions prior to 8.4.6
Rocket.Chat versions prior to 8.3.8
Rocket.Chat versions prior to 8.2.8
Rocket.Chat versions prior to 8.1.8
Rocket.Chat versions prior to 7.10.15
**Description**
The Meteor DDP methods `getThreadsList()` and `getThreadMessages()` accept `rid` and `tmid` as raw, untyped parameters without schema validation. This allows a low-privilege authenticated user to substitute a MongoDB operator object for a string room-id or message-id. While the authorization check may resolve to a room the attacker already has access to, the downstream data query expands across all rooms, leading to the disclosure of private thread parents and their full reply content.
**Recommendations**
Update to version 8.8.0 or later.
Update to version 8.7.1 or later.
Update to version 8.6.2 or later.
Update to version 8.5.3 or later.
Update to version 8.4.6 or later.
Update to version 8.3.8 or later.
Update to version 8.2.8 or later.
Update to version 8.1.8 or later.
Update to version 7.10.15 or later.