Rocket.Chat Program Statistics

View program

95 total issues disclosed

$0 total paid publicly

Most disclosed (13 disclosures) — Information Disclosure

Disclosed Reports

Report Title Vulnerability Type Disclosed By Severity Disclosed on
Unauthenticated Path Traversal (LFI) via /custom-sounds/ when CustomSounds uses FileSystem storage Path Traversal howtoplay High 2026-08-03
Unauthenticated SSRF in Voxtelesys integration ('checkUrlForSsrf' Bypass via DNS rebinding) Server-Side Request Forgery (SSRF) button142857 High 2026-07-29
Authentication Bypass via XML Signature Wrapping in SAML SSO Improper Authentication - Generic 0jayden Critical 2026-07-27
Stored XSS in Rocket.Chat HTML File Export — Unauthenticated Entry via LiveChat Cross-site Scripting (XSS) - Stored olidayw Medium 2026-07-16
Unauthenticated file deletion via deleteFileMessage DDP method allows permanent destruction of any uploaded file Improper Authentication - Generic eldudareeno High 2026-06-16
Unauthenticated reading of every file via livechat auth and predicting MongoDB ObjectId() Improper Access Control - Generic aikido_security Critical 2026-06-15
SSRF via Improper Redirect Validation in Rocket.Chat oEmbed Function Server-Side Request Forgery (SSRF) button142857 Medium 2026-06-11
SSRF via improper validation after DNS name resolution in the link-preview feature Server-Side Request Forgery (SSRF) button142857 High 2026-06-11
Autotranslate DDP Method Exposes Private Messages Without Authentication or Room Access Check Insecure Direct Object Reference (IDOR) deprrous High 2026-05-25
IDOR: autotranslate.translateMessage Full Message Content Leak Insecure Direct Object Reference (IDOR) josan_george Medium 2026-05-18
RBAC bypass on App log endpoints via `permissionRequired` typo — any authenticated user reads admin-only Enterprise App logs Improper Access Control - Generic arccode Medium 2026-04-23
Complete authentication bypass to admin permissions SQL Injection npc Critical 2026-04-22
Open Redirect in Rocket.Chat Open Redirect soohyun Medium 2026-04-10
IDOR vulnerability leads to Deleting message after leaving/getting banned from group using message ID Insecure Direct Object Reference (IDOR) yash24 Low 2024-10-13
The initial E2EE password generated by Rocket.Chat mobile can be recovered in a practical timescale. Use of Insufficiently Random Values h0011 High 2024-10-01
XSS via /api/v1/chat.postMessage Cross-site Scripting (XSS) - Stored gronke Critical 2024-08-10
Guest Privilege Escalation to admin group Improper Access Control - Generic gronke Critical 2024-08-10
Upload of Avatars for other Users Improper Access Control - Generic gronke Medium 2024-08-10
Online Status of arbitrary users can be changed Improper Access Control - Generic gronke Medium 2024-08-10
CSS Injection in Message Avatar Code Injection gronke Medium 2024-08-10
Unread Messages can leak Message IDs Information Disclosure gronke Medium 2024-08-10
Registration bypass with leaked Invite Token Improper Authentication - Generic gronke High 2024-08-10
Unauthenticated clients can modify Livechat Business Hours Improper Access Control - Generic gronke Medium 2024-08-10
Improper ACL in Message Starring Improper Access Control - Generic gronke Medium 2024-08-10
User Impersonation through sendMessage options UI Redressing (Clickjacking) gronke Medium 2024-08-10
Authentication Bypass in login-token Authentication Method Improper Authentication - Generic gronke Critical 2024-08-10
Impersonation in Sequential Messages None supplied gronke Medium 2024-08-10
Content-Security Policy bypass with File Uploads None supplied gronke High 2024-08-10
XSS in various MessageTypes Cross-site Scripting (XSS) - Stored gronke High 2024-08-10
Pinning leaks message content Information Disclosure gronke High 2024-08-10
Bypassing 2FA with conventional session management - open.rocket.chat Improper Authentication - Generic hackeriron1 Low 2024-08-10
Unauthenticated full-read SSRF via Twilio integration Server-Side Request Forgery (SSRF) mokusou High 2024-08-04
Rocket.Chat Desktop client fails to open browser on 3rd party external actions from PDF documents Cleartext Transmission of Sensitive Information itssixtynein Low 2024-07-11
NoSQL injection leaks visitor token and livechat messages Information Disclosure gronke Medium 2024-07-11
Server-side RCE through directory traversal-based arbitrary file write Path Traversal fabianfreyer Critical 2023-07-10
Reflected Cross-Site Scripting(CVE-2022-32770 ) Cross-site Scripting (XSS) - Reflected sachinrajput High 2023-06-22
Clickjacking at open.rocket.chat UI Redressing (Clickjacking) scriptsavvy Medium 2023-06-15
NoSQL injection in listEmojiCustom method call SQL Injection rijalrojan High 2023-05-09
Cross-Site-Scripting in "Search Messages" Cross-site Scripting (XSS) - Stored sectex Medium 2023-05-09
Mute User can disclose private channel members to unauthorized users Information Disclosure gronke Medium 2023-05-09
Maliciously crafted message can cause Rocket.Chat server to stop responding Uncontrolled Resource Consumption vv9k Medium 2023-05-09
Moving private messages into vision with updateMessage method Information Disclosure gronke High 2023-05-09
Retrospective change of message timestamp and order None supplied gronke Medium 2023-04-25
Messages can be hidden regardless of server configuration None supplied gronke Medium 2023-04-25
Improper Access Control - Generic Improper Access Control - Generic priyank_parmar Low 2023-04-25
Rocket.Chat Server RCE Command Injection - Generic yuske Critical 2023-03-04
Low authorization level at server side API operation e2e.updateGroupKey, let an attacker break the E2E architecture. Improper Access Control - Generic f0ns1 High 2023-02-16
Insecure use of shell.openExternal() leads to RCE in Rocket.Chat-Desktop OS Command Injection sectex High 2022-12-08
getUsersOfRoom discloses users in private channels None supplied gronke Medium 2022-09-22
Rocket.chat user info security issue Cleartext Transmission of Sensitive Information mikolajczak Medium 2022-09-22
Message ID Enumeration with Regular Expression in getReadReceipts Meteor method Information Disclosure gronke Medium 2022-09-22
API route chat.getThreadsList leaks private message content Information Disclosure gronke High 2022-09-22
NoSQL-Injection discloses S3 File Upload URLs Information Disclosure gronke Medium 2022-09-22
getRoomRoles Method leaks Channel Owner Information Disclosure gronke Medium 2022-09-22
TOTP 2 Factor Authentication Bypass Improper Authentication - Generic gronke High 2022-09-22
Message ID Enumeration with Action Link Handler Information Disclosure gronke Medium 2022-09-22
REST API gets `query` as parameter and executes it Information Disclosure paulocsanz Medium 2022-09-22
Unintended information disclosure in the Hubot Log files Cleartext Storage of Sensitive Information rolfzur Medium 2022-09-22
Bypass local authentication (PIN code) Improper Authentication - Generic dago_669 Medium 2022-09-22
getUserMentionsByChannel leaks messages with mention from private channel Information Disclosure gronke High 2022-09-22
It is possible to elevate privileges for any authenticated user to view permissions matrix and view Direct messages without appropriate permissions. Privilege Escalation garretby Medium 2022-09-22
Persistent CSS injection with ’marked’ markdown parser in Rocket.Chat Cross-site Scripting (XSS) - Stored danieljpp High 2022-09-22
Regex account takeover SQL Injection ghaem51 Critical 2022-09-22
Insecure use of shell.openExternal() in Rocket.Chat Desktop App leading to RCE OS Command Injection baltpeter Critical 2022-08-01
Possible Domain Takeover on AWS Instance. Phishing samuelsiv Low 2022-05-22
Arbitrary file read in Rocket.Chat-Desktop None supplied sectex Medium 2022-02-06
Blind XSS Cross-site Scripting (XSS) - Generic cyberasset Low 2021-12-07
Custom crafted message object in Meteor.Call allows remote code execution and impersonation Code Injection wreiske Critical 2021-10-11
Post-Auth Blind NoSQL Injection in the users.list API leads to Remote Code Execution None supplied sonarsource High 2021-07-31
Post-Auth Stored XSS with User Interaction leads to Remote Code Execution Cross-site Scripting (XSS) - Stored sonarsource High 2021-06-30
Pre-Auth Blind NoSQL Injection leading to Remote Code Execution None supplied sonarsource Critical 2021-05-18
Hi! Security Team Rocket.Chat, It's possible to get information about the users emails without authentication Information Disclosure khekhe Low 2021-04-29
Account takeover via XSS Cross-site Scripting (XSS) - Stored sectex Critical 2021-03-31
Stored XSS in any message (leads to priv esc for all users and file leak + rce via electron app) Cross-site Scripting (XSS) - DOM psych0tr1a High 2021-03-25
Android App Crashes while sending message to users/ on channel Classic Buffer Overflow legalizenepal High 2021-03-18
XSS in message attachment fileds. Cross-site Scripting (XSS) - Stored fabianfreyer Critical 2021-01-17
Session Hijack via Self-XSS Cross-site Scripting (XSS) - DOM jcardona Medium 2021-01-17
SAML authentication bypass through unauthenticated `addSamlProvider` Meteor Call Improper Access Control - Generic fabianfreyer Critical 2021-01-08
XSS leads to RCE on the RocketChat desktop client. OS Command Injection fabianfreyer Critical 2021-01-01
Remote Code Execution in Rocket.Chat-Desktop None supplied sectex Critical 2020-11-07
Desktop app RCE (#276031 bypass) Code Injection ivarsvids High 2020-11-05
[Security Vulnerability Rocket.chat] HTML Injection into Email via Signup Code Injection steven_julian22 Medium 2020-06-24
SAML authentication bypass Improper Authentication - Generic tomp1 High 2020-06-18
account takeover on 3.0.1 version Insecure Direct Object Reference (IDOR) elfiman Critical 2020-06-14
API Keys Hardcoded in Github repository Use of Hard-coded Credentials codermak Medium 2020-04-01
XSS (leads to arbitrary file read in Rocket.Chat-Desktop) Cross-site Scripting (XSS) - Stored sectex Low 2020-01-02
Clickjacking in the admin page UI Redressing (Clickjacking) ant_pyne Low 2020-01-02
Open redirect open.rocket.chat/file-upload/ID/filename.svg Open Redirect w2w Medium 2019-10-31
Blind SQL injection in third-party software, that allows to reveal user statistic from rocket.chat and possibly hack into the rocketchat.agilecrm.com SQL Injection w2w No rating 2019-10-17
Slack Token exposed over internet (Github) Cleartext Storage of Sensitive Information sanjogpanda None 2019-07-11
Broken access control on apps Improper Access Control - Generic theappsec Critical 2019-06-22
XSS (stored) Wizard is saving executable code Cross-site Scripting (XSS) - Stored 24nitin Medium 2018-09-27
Blind XSS in the rocket.chat registration email Cross-site Scripting (XSS) - Stored edoverflow No rating 2018-09-26
Remote Code Execution in Rocket.Chat Desktop Code Injection mattaustin High 2018-09-19
Remote code execution by hijacking an unclaimed S3 bucket in Rocket.Chat's installation script. Code Injection edoverflow Medium 2018-08-28