Authentication Bypass in Rocket.Chat WebSocket Stream

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: GitHub, Inc.

Description

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1, the stream-notify-user stream in the WebSocket protocol allows an authenticated user to write arbitrary notification bodies because the sender is not checked, and the client-side UI can create an ephemeral fake message in another user's currently open chat. This issue is fixed in versions 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-10

Generated

2026-08-11

AI Q&A

2026-08-11

EPSS Evaluated

N/A

NVD

CVE-2026-72918

Affected Vendors & Products

Vendor	Product	Version / Range
rocket.chat	rocket.chat	to 7.10.14 (exc)
rocket.chat	rocket.chat	7.10.14
rocket.chat	rocket.chat	8.0.8
rocket.chat	rocket.chat	8.1.7
rocket.chat	rocket.chat	8.2.7
rocket.chat	rocket.chat	8.3.7
rocket.chat	rocket.chat	8.4.5
rocket.chat	rocket.chat	8.5.2
rocket.chat	rocket.chat	8.6.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

Rocket.Chat versions before 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1 have a vulnerability in the stream-notify-user WebSocket stream. An authenticated user can send fake notifications that appear to come from another user by exploiting missing sender verification. The client-side UI can create ephemeral fake messages in another user's chat.

Impact Analysis

This vulnerability allows an attacker with valid credentials to impersonate other users in chat notifications. It could lead to misinformation, phishing attempts, or social engineering attacks within the Rocket.Chat environment. The impact is limited to notification spoofing as it does not allow direct message interception or modification.

Mitigation Strategies

Immediately update Rocket.Chat to a patched version (7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, or 8.6.1 or later) to fix the stream-notify-user vulnerability.

Hi! I’m here to help you understand CVE-2026-72918. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70