CVE-2026-48929

Name of the Vulnerable Software and Affected Versions Rocket.Chat versions prior to 8.5.1 Rocket.Chat versions prior to 8.4.4 Rocket.Chat versions prior to 8.3.6 Rocket.Chat versions prior to 8.2.6 Rocket.Chat versions prior to 8.1.6 Rocket.Chat versions prior to 8.0.7 Rocket.Chat versions prior to 7.13.9 Rocket.Chat versions prior to 7.10.13

Description An issue allows unauthenticated file deletion via the deleteFileMessage Meteor method. When this method is called through an unauthenticated DDP (Distributed Data Protocol) WebSocket connection, the Meteor.userId() function returns null, which bypasses the authorization check. This leads to the execution of FileUpload.getStore('Uploads').deleteById(fileID), resulting in the unconditional removal of the file from both storage and the database. The required fileID can be obtained from download URLs or public channel message payloads.

Recommendations Update to version 8.5.1 or later. Update to version 8.4.4 or later. Update to version 8.3.6 or later. Update to version 8.2.6 or later. Update to version 8.1.6 or later. Update to version 8.0.7 or later. Update to version 7.13.9 or later. Update to version 7.10.13 or later.