CVE-2026-72919

Name of the Vulnerable Software and Affected Versions Rocket.Chat versions prior to 7.10.14 Rocket.Chat versions prior to 8.0.8 Rocket.Chat versions prior to 8.1.7 Rocket.Chat versions prior to 8.2.7 Rocket.Chat versions prior to 8.3.7 Rocket.Chat versions prior to 8.4.5 Rocket.Chat versions prior to 8.5.2 Rocket.Chat versions prior to 8.6.1

Description An authenticated registered user with the create-team permission can convert an unrelated public channel into a team. This occurs because the 'channels.convertToTeam' REST endpoint only verifies the edit-room permission when a channelId is provided, allowing the conversion to proceed if channelName is supplied instead.

Recommendations Update to version 7.10.14 Update to version 8.0.8 Update to version 8.1.7 Update to version 8.2.7 Update to version 8.3.7 Update to version 8.4.5 Update to version 8.5.2 Update to version 8.6.1