Rocket.Chat's sendForgotPasswordEmail Meteor method is exposed without a DDP rate limit, enabling unauthenticated callers to invoke it repeatedly via DDP or the HTTP POST /api/v1/method.callAnon/sendForgotPasswordEmail endpoint. This triggers password reset emails for any matching account address. Because no DDPRateLimiter rule is registered for this method in affected versions, attackers can send an unbounded number of reset emails from the deployment's mail sender and distinguish account types based on method responses. Later versions introduce a rate limiting rule allowing ten calls per minute per client address to mitigate abuse.

An attacker can abuse this vulnerability to send a large volume of password reset emails to a victim, potentially causing denial of service through email flooding. Additionally, the attacker can enumerate user accounts and differentiate between normal accounts and those authenticating via external providers with password changes disabled, potentially aiding targeted attacks or reconnaissance.

Later versions of Rocket.Chat have implemented a DDPRateLimiter rule restricting the sendForgotPasswordEmail method to ten calls per minute per client address, effectively mitigating the issue. Users should upgrade to these versions to benefit from the built-in rate limiting. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor advisory for the latest remediation guidance.