Rocket.Chat up to 8.4.x Message Endpoint autotranslate.translateMessage access control

Summaryinfo

A vulnerability categorized as critical has been discovered in Rocket.Chat up to 8.4.x. Affected by this vulnerability is an unknown functionality of the file /api/v1/autotranslate.translateMessage of the component Message Endpoint. Executing a manipulation can lead to access control. This vulnerability is registered as CVE-2026-32994. It is possible to launch the attack remotely. No exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability has been found in Rocket.Chat up to 8.4.x and classified as problematic. This vulnerability affects an unknown functionality of the file /api/v1/autotranslate.translateMessage of the component Message Endpoint. The manipulation with an unknown input leads to a access control vulnerability. The CWE definition for the vulnerability is CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. As an impact it is known to affect confidentiality. CVE summarizes:

The /api/v1/autotranslate.translateMessage endpoint in versions <8.5.0, <8.4.2, <8.3.4, <8.2.4, <8.1.5, <8.0.6, <7.13.8, and <7.10.12 allows any authenticated user to retrieve the full content of any message from any room (private groups, direct messages, channels) by simply providing the target message ID. The endpoint fetches the message via Messages.findOneById(messageId) with no room access check (canAccessRoomIdAsync is never called), returning the complete IMessage object including message text, sender info, room ID, timestamps, and markdown content.

The advisory is shared for download at hackerone.com. This vulnerability was named CVE-2026-32994 since 03/17/2026. The exploitation appears to be difficult. The attack can be initiated remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1068.

Upgrading to version 7.10.12, 7.13.8, 8.0.6, 8.1.5, 8.2.4, 8.3.4, 8.4.2 or 8.5.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-30835). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Chat Software

Name

• Rocket.Chat

Version

• 7.10.0
• 7.10.1
• 7.10.2
• 7.10.3
• 7.10.4
• 7.10.5
• 7.10.6
• 7.10.7
• 7.10.8
• 7.10.9
• 7.10.10
• 7.10.11
• 7.13.0
• 7.13.1
• 7.13.2
• 7.13.3
• 7.13.4
• 7.13.5
• 7.13.6
• 7.13.7
• 8.0
• 8.0.0
• 8.0.1
• 8.0.2
• 8.0.3
• 8.0.4
• 8.0.5
• 8.1
• 8.1.0
• 8.1.1
• 8.1.2
• 8.1.3
• 8.1.4
• 8.2
• 8.2.0
• 8.2.1
• 8.2.2
• 8.2.3
• 8.3
• 8.3.0
• 8.3.1
• 8.3.2
• 8.3.3
• 8.4
• 8.4.0
• 8.4.1

License

• free

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion