CVE-2026-72919

Received Received - Intake

Authentication Bypass in Rocket.Chat via Channel Conversion

Publication date: 2026-08-10

Last updated on: 2026-08-11

Assigner: GitHub, Inc.

Description

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1, the channels.convertToTeam REST endpoint allows an authenticated registered user with the create-team permission to convert an unrelated public channel by supplying channelName instead of channelId because the edit-room permission is checked only for channelId. This issue is fixed in versions 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-11

Generated

2026-08-31

AI Q&A

2026-08-11

EPSS Evaluated

2026-08-29

NVD

CVE-2026-72919

Affected Vendors & Products

Vendor	Product	Version / Range
rocket.chat	rocket.chat	to 7.10.14 (exc)
rocket.chat	rocket.chat	to 8.0.8 (exc)
rocket.chat	rocket.chat	to 8.1.7 (exc)
rocket.chat	rocket.chat	to 8.2.7 (exc)
rocket.chat	rocket.chat	to 8.3.7 (exc)
rocket.chat	rocket.chat	to 8.4.5 (exc)
rocket.chat	rocket.chat	to 8.5.2 (exc)
rocket.chat	rocket.chat	to 8.6.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

Rocket.Chat versions before 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1 have a flaw in the channels.convertToTeam REST endpoint. An authenticated user with create-team permission can convert an unrelated public channel to a team by providing the channel name instead of the correct channel ID. This happens because the system checks edit-room permission only when a channel ID is supplied.

Detection Guidance

This vulnerability can be detected by checking the Rocket.Chat server version. If the version is below 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, or 8.6.1, the system is vulnerable. Use commands like 'curl -s http://your-rocketchat-server.com/api/info | grep version' to check the version.

Impact Analysis

An attacker with create-team permission could convert public channels they don't own into teams, potentially disrupting communication channels or gaining unauthorized access to channel content. This could lead to data exposure or misuse of team features.

Compliance Impact

The vulnerability allows unauthorized conversion of public channels, which could lead to improper access control and data exposure. This may violate compliance requirements for data protection and access management in standards like GDPR and HIPAA, where strict access controls and auditability are mandatory.

Mitigation Strategies

Update Rocket.Chat to a patched version (7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, or 8.6.1 or later) to fix the vulnerability in the channels.convertToTeam endpoint.

Hi! I’m here to help you understand CVE-2026-72919. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70