PT-2026-52098 · Rocket.Chat · Rocket.Chat

CVE-2026-49277

·

Published

2026-06-24

·

Updated

2026-06-24

CVSS v4.0

2.3

Low

VectorAV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions Rocket.Chat versions prior to 8.5.0 Rocket.Chat versions prior to 8.4.2 Rocket.Chat versions prior to 8.3.4 Rocket.Chat versions prior to 8.2.4 Rocket.Chat versions prior to 8.1.5 Rocket.Chat versions prior to 8.0.6 Rocket.Chat versions prior to 7.13.8 Rocket.Chat versions prior to 7.10.12
Description Rocket.Chat fails to revoke OAuth bearer or refresh tokens when a user account is deactivated. This allows a deactivated user to maintain access using an existing OAuth access token or to generate a new access token using an existing refresh token.
Recommendations Update to version 8.5.0 Update to version 8.4.2 Update to version 8.3.4 Update to version 8.2.4 Update to version 8.1.5 Update to version 8.0.6 Update to version 7.13.8 Update to version 7.10.12

Exploit

Fix

Insufficient Session Expiration

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

CVE-2026-49277
GHSA-39HG-492F-3C4F

Affected Products

Rocket.Chat