Authentication Bypass in Rocket.Chat via Channel Conversion

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: GitHub, Inc.

Description

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1, the channels.convertToTeam REST endpoint allows an authenticated registered user with the create-team permission to convert an unrelated public channel by supplying channelName instead of channelId because the edit-room permission is checked only for channelId. This issue is fixed in versions 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-10

Generated

2026-08-11

AI Q&A

2026-08-11

EPSS Evaluated

N/A

NVD

CVE-2026-72919

Affected Vendors & Products

Vendor	Product	Version / Range
rocket.chat	rocket.chat	to 7.10.14 (exc)
rocket.chat	rocket.chat	to 8.0.8 (exc)
rocket.chat	rocket.chat	to 8.1.7 (exc)
rocket.chat	rocket.chat	to 8.2.7 (exc)
rocket.chat	rocket.chat	to 8.3.7 (exc)
rocket.chat	rocket.chat	to 8.4.5 (exc)
rocket.chat	rocket.chat	to 8.5.2 (exc)
rocket.chat	rocket.chat	to 8.6.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

Rocket.Chat versions before 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1 have a flaw in the channels.convertToTeam REST endpoint. An authenticated user with create-team permission can convert an unrelated public channel to a team by providing the channel name instead of the correct channel ID. This happens because the system checks edit-room permission only when a channel ID is supplied.

Impact Analysis

An attacker with create-team permission could convert public channels they don't own into teams, potentially disrupting communication channels or gaining unauthorized access to channel content. This could lead to data exposure or misuse of team features.

Mitigation Strategies

Update Rocket.Chat to a patched version (7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, or 8.6.1 or later) to fix the vulnerability in the channels.convertToTeam endpoint.

Hi! I’m here to help you understand CVE-2026-72919. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70