CVE-2026-72918

Name of the Vulnerable Software and Affected Versions Rocket.Chat versions prior to 7.10.14 Rocket.Chat versions prior to 8.0.8 Rocket.Chat versions prior to 8.1.7 Rocket.Chat versions prior to 8.2.7 Rocket.Chat versions prior to 8.3.7 Rocket.Chat versions prior to 8.4.5 Rocket.Chat versions prior to 8.5.2 Rocket.Chat versions prior to 8.6.1

Description An insecure implementation of the WebSocket protocol allows an authenticated user to write arbitrary notification bodies via the stream-notify-user stream. This occurs because the sender is not verified, enabling the client-side UI to create an ephemeral fake message within another user's active chat session.

Recommendations Update to version 7.10.14 Update to version 8.0.8 Update to version 8.1.7 Update to version 8.2.7 Update to version 8.3.7 Update to version 8.4.5 Update to version 8.5.2 Update to version 8.6.1