CVE-2026-75575: Improper Restriction of Excessive Authentication Attempts in RocketChat Rocket.Chat

Rocket.Chat's sendForgotPasswordEmail Meteor method is exposed without a DDP rate limit, allowing unauthenticated callers to invoke it repeatedly via DDP or the HTTP POST /api/v1/method.callAnon/sendForgotPasswordEmail endpoint. This triggers password reset emails for any matching account address. Due to the absence of a DDPRateLimiter rule, attackers can send an unbounded volume of reset emails from the deployment's mail sender and probe addresses at scale. The method's response differentiates between addresses without accounts, accounts with password reset enabled, and accounts authenticating via external providers with password change disabled, enabling user enumeration. Fixed versions introduce a rate limit of ten calls per minute per client address.

An attacker can cause denial of service to users by flooding their email with password reset messages, potentially disrupting legitimate password recovery processes. Additionally, the vulnerability allows user enumeration by distinguishing account types based on method responses. There is no indication of privilege escalation or direct system compromise. The CVSS 4.0 base score is 6.9, reflecting a medium severity impact with network attack vector, no privileges or user interaction required, and low confidentiality impact.

Upgrade Rocket.Chat to versions that include the DDPRateLimiter rule for sendForgotPasswordEmail, which limits calls to ten per minute per client IP address. The affected versions are prior to 7.10.15, 8.1.8, 8.2.8, 8.3.8, 8.4.6, 8.5.3, 8.6.2, 8.7.2, and 8.8.0. Applying these updates will mitigate the vulnerability. No other vendor advisory or patch information is provided, so check official Rocket.Chat release notes for confirmation and further guidance.