CVE-2026-65645

Name of the Vulnerable Software and Affected Versions Rocket.Chat versions prior to 8.8.0 Rocket.Chat versions prior to 8.7.1 Rocket.Chat versions prior to 8.6.2 Rocket.Chat versions prior to 8.5.3 Rocket.Chat versions prior to 8.4.6 Rocket.Chat versions prior to 8.3.8 Rocket.Chat versions prior to 8.2.8 Rocket.Chat versions prior to 8.1.8 Rocket.Chat versions prior to 7.10.15

Description The Meteor DDP methods getThreadsList() and getThreadMessages() accept rid and tmid as raw, untyped parameters without schema validation. This allows a low-privilege authenticated user to substitute a MongoDB operator object for a string room-id or message-id. While the authorization check may resolve to a room the attacker already has access to, the downstream data query expands across all rooms, leading to the disclosure of private thread parents and their full reply content.

Recommendations Update to version 8.8.0 or later. Update to version 8.7.1 or later. Update to version 8.6.2 or later. Update to version 8.5.3 or later. Update to version 8.4.6 or later. Update to version 8.3.8 or later. Update to version 8.2.8 or later. Update to version 8.1.8 or later. Update to version 7.10.15 or later.