CVE-2026-65645
Received Received - Intake

Path Traversal in Rocket.Chat via Unvalidated DDP Parameters

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: HackerOne

Description
Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6. 8.3.8, 8.2.8, 8.1.8, and 7.10.15, the Meteor DDP methods getThreadsList and getThreadMessages accept rid / tmid as raw, untyped parameters with no schema validation. A MongoDB operator object (e.g. {"$gt": "4"}) can be substituted for a string room-id or message-id. The authorization check resolves to a room the attacker already has access to, while the downstream data query fans out across all rooms - disclosing private thread parents and their full reply content to any low-privilege authenticated user. The REST route chat.getThreadsList was patched in v5.0 (HackerOne report #1446767) by adding rid: {type:'string'} AJV validation. The equivalent DDP method was never given the same fix and remains exploitable

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-21
Last Modified
2026-08-21
Generated
2026-08-21
AI Q&A
2026-08-21
EPSS Evaluated
N/A
NVD
CVE-2026-65645
EUVD
EUVD-2026-63805

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
rocket_chat rocket_chat to 8.8.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Rocket.Chat versions before 8.8.0 have a flaw in the Meteor DDP methods getThreadsList and getThreadMessages where raw parameters like room-id or message-id are not validated. Attackers can inject MongoDB operators (e.g., {$gt: "4"}) to bypass authorization checks and access private thread content across all rooms they have access to, even if they only have low privileges.

Detection Guidance

To detect this vulnerability, check if your Rocket.Chat server version is below 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, or 7.10.15. Verify if the DDP methods getThreadsList and getThreadMessages lack schema validation for rid/tmid parameters. Review logs for unauthorized access to private threads or messages by low-privilege users.

Impact Analysis

An attacker with low-privilege access could read private conversations, including thread parents and their replies, in rooms they are authorized to access. This could lead to unauthorized data exposure of sensitive information shared in private threads.

Compliance Impact

This vulnerability could result in unauthorized access to personal or sensitive data, violating GDPR's data protection principles and HIPAA's privacy rules. Organizations using vulnerable Rocket.Chat versions may face compliance breaches and potential regulatory penalties.

Mitigation Strategies

Upgrade Rocket.Chat to a patched version (8.8.0 or later) to address the vulnerability in the getThreadsList and getThreadMessages methods. The fix involves adding schema validation for room and message IDs to prevent MongoDB operator injection.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65645. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart