CVE-2026-45757 describes an insufficient session expiration vulnerability in Rocket.Chat affecting versions before 8.5.0 (including multiple intermediate versions). Specifically, users deactivated through the users.deactivateIdle mechanism can still use their existing login tokens to access authenticated REST endpoints. This means that session tokens are not invalidated upon user deactivation for idleness, allowing continued access despite administrative deactivation. The vulnerability is categorized under CWE-613 (Insufficient Session Expiration). No official remediation level or patch links are provided in the data, but the description states the issue is fixed starting from versions 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12.

Users who have been deactivated due to inactivity can still access authenticated REST endpoints using their previously issued login tokens. This could allow unauthorized access to the system by users who should no longer have access. The impact is limited by the low CVSS score (2.3) and the requirement for user interaction (UI:P) and high attack complexity (AC:H). There is no indication of privilege escalation or data exfiltration beyond the continued access of deactivated accounts.

The vulnerability is fixed in Rocket.Chat versions 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12. Users should upgrade to one of these fixed versions to remediate the issue. Patch status is not explicitly confirmed beyond the stated fixed versions, so verifying with the vendor advisory is recommended for current remediation guidance.