Unauthenticated File Access in Rocket.Chat

Compliance Impact

The vulnerability in Rocket.Chat allows unauthenticated discovery and access to uploaded files due to improper authorization checks and predictable file IDs. This exposure of potentially sensitive files could lead to unauthorized data access.

Such unauthorized access to files may impact compliance with data protection regulations like GDPR and HIPAA, which require strict controls on personal and sensitive data access and confidentiality.

However, the provided information does not explicitly state the direct impact on compliance or mention specific regulatory consequences.

Useful 0 Not Useful 0

Executive Summary

The vulnerability exists in Rocket.Chat versions prior to 8.5.1 and some specific earlier versions. It is an access control flaw in the Livechat file download functionality. The system authorizes access to protected files using parameters rc_room_type=l with rc_rid and rc_token, but it does not verify that the rc_rid parameter matches the requested file's room ID (rid).

Additionally, the file identifier (:fileId) is predictable because it uses sequential MongoDB IDs, and the file name (:name) can be arbitrary. This combination allows an unauthenticated attacker to discover and access all uploaded files without proper authorization.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized access to sensitive or private files uploaded via the Livechat feature in Rocket.Chat. Because the file IDs are predictable and authorization checks are insufficient, attackers can enumerate and download files they should not have access to.

The impact includes potential exposure of confidential information, privacy breaches, and data leakage. The CVSS score of 9.3 indicates a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should update Rocket.Chat to a patched version where the security issue has been fixed.

The security fix was included in a pull request merged on June 11, 2026, which was backported to versions 8.6.0, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, 7.13.9, and 7.10.13. Applying these updates will address the access control vulnerability in Livechat file downloads.

Useful 0 Not Useful 0