The REST route chat.getThreadsList was patched in v5.0 (HackerOne report #1446767) by adding rid: {type:'string'} AJV validation. The equivalent DDP method was never given the same fix and remains exploitable
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Rocket.Chat | Rocket.Chat | unaffected |
|
No data.
No data.
| Vendor | Product | Confidence | Versions | ||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Rocket.chat | Rocket.chat | 100% |
|
Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Fri, 21 Aug 2026 04:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | MongoDB Operator Injection Exposes Private Threads in Rocket.Chat | |
| First Time appeared |
Rocket.chat
Rocket.chat rocket.chat |
|
| Weaknesses | CWE-20 | |
| Vendors & Products |
Rocket.chat
Rocket.chat rocket.chat |
Fri, 21 Aug 2026 03:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6. 8.3.8, 8.2.8, 8.1.8, and 7.10.15, the Meteor DDP methods getThreadsList and getThreadMessages accept rid / tmid as raw, untyped parameters with no schema validation. A MongoDB operator object (e.g. {"$gt": "4"}) can be substituted for a string room-id or message-id. The authorization check resolves to a room the attacker already has access to, while the downstream data query fans out across all rooms - disclosing private thread parents and their full reply content to any low-privilege authenticated user. The REST route chat.getThreadsList was patched in v5.0 (HackerOne report #1446767) by adding rid: {type:'string'} AJV validation. The equivalent DDP method was never given the same fix and remains exploitable | |
| References |
|
MITRE
Status: PUBLISHED
Assigner: hackerone
Published:
Updated: 2026-08-21T02:53:43.305Z
Reserved: 2026-07-22T15:00:06.104Z
Link: CVE-2026-65645
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-08-21T04:18:14.690
Modified: 2026-08-21T04:18:14.690
Link: CVE-2026-65645
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-08-21T04:30:09Z