The vulnerability in Rocket.Chat affects the Meteor DDP methods getThreadsList and getThreadMessages by accepting untyped parameters (rid / tmid) without schema validation. An attacker can substitute a MongoDB operator object in place of expected string identifiers, bypassing authorization checks that only verify access to a single room. This leads to a data query that leaks private thread parent messages and their replies across all rooms to low-privilege authenticated users. The REST API route chat.getThreadsList was fixed in version 5.0 by adding AJV validation for the rid parameter, but the DDP methods were not similarly fixed and remain vulnerable. No CVSS score is available, and no known exploits in the wild have been reported.

Low-privilege authenticated users can exploit this vulnerability to access private thread parent messages and their full reply content across all rooms, violating confidentiality of private communications within Rocket.Chat instances. This unauthorized data disclosure can lead to exposure of sensitive information shared in private threads.

As of the information provided, the REST API route chat.getThreadsList has been patched since version 5.0 with proper parameter validation. However, the Meteor DDP methods getThreadsList and getThreadMessages remain unpatched and exploitable. Users should monitor vendor advisories for updates addressing the DDP method vulnerability and apply official patches once available. Until then, consider restricting access to the affected DDP methods or limiting authenticated user permissions as a temporary mitigation. Patch status is not yet confirmed for the DDP methods—check the vendor advisory for current remediation guidance.