Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6. (CVE-2026-65645)

The vulnerability (CVE-2026-65645) in Rocket.Chat affects multiple versions before 8.8.0 and related patch versions. The Meteor DDP methods getThreadsList and getThreadMessages do not validate input parameters (rid / tmid) properly, accepting MongoDB operator objects instead of strings. This bypasses authorization checks that only verify access to a single room, while the underlying query leaks data from all rooms. Consequently, low-privilege authenticated users can access private thread parent messages and their replies. Although the REST API route chat.getThreadsList was fixed in version 5.0 by adding strict AJV validation for the rid parameter, the DDP methods were not patched and remain exploitable.

The vulnerability allows any authenticated user with low privileges to access private thread parent messages and their full reply content across all rooms, violating confidentiality. There is no indication of integrity or availability impact. The CVSS score of 4.3 reflects a medium severity confidentiality breach with network attack vector and low complexity.

No official patch or fix is confirmed for the vulnerable DDP methods as of the provided data. The REST route was patched in version 5.0, but the DDP methods remain unpatched. Users should monitor vendor advisories for updates addressing the DDP methods. Until a fix is available, restricting access to authenticated users and minimizing exposure of sensitive threads may reduce risk.