CVE-2026-65645: Rocket.Chat Rocket.Chat vulnerability
Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6. 8.3.8, 8.2.8, 8.1.8, and 7.10.15, the Meteor DDP methods getThreadsList and getThreadMessages accept rid / tmid as raw, untyped parameters with no schema validation. A MongoDB operator object (e.g. {"$gt": "4"}) can be substituted for a string room-id or message-id. The authorization check resolves to a room the attacker already has access to, while the downstream data query fans out across all rooms - disclosing private thread parents and their full reply content to any low-privilege authenticated user. The REST route chat.getThreadsList was patched in v5.0 (HackerOne report #1446767) by adding rid: {type:'string'} AJV validation. The equivalent DDP method was never given the same fix and remains exploitable
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Meteor DDP methods getThreadsList and getThreadMessagesto a version that resolves this vulnerability.Fixed in 8.3.8 - Upgrade
Upgrade
Meteor DDP methods getThreadsList and getThreadMessagesto a version that resolves this vulnerability.Fixed in 8.2.8 - Upgrade
Upgrade
Meteor DDP methods getThreadsList and getThreadMessagesto a version that resolves this vulnerability.Fixed in 8.1.8 - Upgrade
Upgrade
Meteor DDP methods getThreadsList and getThreadMessagesto a version that resolves this vulnerability.Fixed in 7.10.15 - Upgrade
Upgrade
Rocket.Chatto a version that resolves this vulnerability.Fixed in 8.8.0 - Upgrade
Upgrade
Rocket.Chatto a version that resolves this vulnerability.Fixed in 8.7.1 - Upgrade
Upgrade
Rocket.Chatto a version that resolves this vulnerability.Fixed in 8.6.2 - Upgrade
Upgrade
Rocket.Chatto a version that resolves this vulnerability.Fixed in 8.5.3 - Upgrade
Upgrade
Rocket.Chatto a version that resolves this vulnerability.Fixed in 8.4.6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch HackerOne report #1446767 - Configuration
Ensure chat.getThreadsList validates rid as a string using AJV schema validation (as patched in v5.0 referenced by HackerOne report #1446767).
REST route chat.getThreadsList AJV schema validation for rid = rid: {type:'string'} - Configuration
Add schema validation (e.g., rid and tmid typed as strings) to the DDP methods getThreadsList and getThreadMessages to match the REST route fix; currently they accept rid / tmid as raw, untyped parameters with no schema validation and remain exploitable.
Meteor DDP methods getThreadsList and getThreadMessages Input schema validation for rid and tmid = rid and tmid should be typed/validated (not raw, untyped)
Event History
Frequently Asked Questions
Who can exploit this issue?
Any low-privilege authenticated user who has access to at least one room can exploit it. The issue can disclose private thread parent messages and complete thread replies from other rooms.
What does an attacker need to send?
The attacker must invoke the Meteor DDP getThreadsList or getThreadMessages method and supply a MongoDB operator object, such as {"$gt":"4"}, in place of the expected string room ID or thread/message ID. The authorization check can then succeed against a room the attacker is allowed to access while the subsequent query returns data across rooms.
Are REST API users affected in the same way?
The described issue is in the DDP methods. The REST chat.getThreadsList route received string-type AJV validation in version 5.0, but the equivalent DDP method did not receive that fix.
Which versions need remediation?
Upgrade to a fixed release: 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, or 7.10.15, depending on the release branch in use. Versions before those releases are affected.