RocketChat Rocket.Chat up to 8.6.0 Stream-Notify-User Stream privileges management

Summaryinfo

A vulnerability labeled as problematic has been found in RocketChat Rocket.Chat up to 8.6.0. Affected is an unknown function of the component Stream-Notify-User Stream. The manipulation results in privileges management. This vulnerability is identified as CVE-2026-72918. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability classified as problematic has been found in RocketChat Rocket.Chat up to 8.6.0. Affected is an unknown part of the component Stream-Notify-User Stream. The manipulation with an unknown input leads to a privileges management vulnerability. CWE is classifying the issue as CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. This is going to have an impact on integrity. CVE summarizes:

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1, the stream-notify-user stream in the WebSocket protocol allows an authenticated user to write arbitrary notification bodies because the sender is not checked, and the client-side UI can create an ephemeral fake message in another user's currently open chat. This issue is fixed in versions 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-72918 since 08/10/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1068.

Upgrading to version 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2 or 8.6.1 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Chat Software

Vendor

• RocketChat

Name

• Rocket.Chat

Version

• 7.10.0
• 7.10.1
• 7.10.2
• 7.10.3
• 7.10.4
• 7.10.5
• 7.10.6
• 7.10.7
• 7.10.8
• 7.10.9
• 7.10.10
• 7.10.11
• 7.10.12
• 7.10.13
• 8.0
• 8.0.0
• 8.0.1
• 8.0.2
• 8.0.3
• 8.0.4
• 8.0.5
• 8.0.6
• 8.0.7
• 8.1
• 8.1.0
• 8.1.1
• 8.1.2
• 8.1.3
• 8.1.4
• 8.1.5
• 8.1.6
• 8.2
• 8.2.0
• 8.2.1
• 8.2.2
• 8.2.3
• 8.2.4
• 8.2.5
• 8.2.6
• 8.3
• 8.3.0
• 8.3.1
• 8.3.2
• 8.3.3
• 8.3.4
• 8.3.5
• 8.3.6
• 8.4
• 8.4.0
• 8.4.1
• 8.4.2
• 8.4.3
• 8.4.4
• 8.5
• 8.5.0
• 8.5.1
• 8.6.0

License

• free

Website

• Product: https://github.com/RocketChat/Rocket.Chat/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion