CRITICAL🇵🇱 Wersja polska

CVE-2026-29198

CVSS 9.8v3.1pub. 2026-04-23upd. 2026-05-13

In Rocket.Chat <8.3.0, <8.2.1, <8.1.2, <8.0.3, <7.13.5, <7.12.6, <7.11.6, and <7.10.9, a NoSQL injection vulnerability can lead to account takeover of the first user with a generated token when an OAuth app is configured.

🇵🇱 Read Polish description →

🤖 AI Analysis

How it works

The vulnerability results from improper input validation in the context of NoSQL database queries. When an OAuth application is configured in the Rocket.Chat instance, an attacker can craft a malicious query containing NoSQL operators, thereby bypassing authentication mechanisms. As a result, it is possible to locate and take over the account of the first user for whom an access token was generated.

Impact

An unauthenticated attacker can completely take over a user account (account takeover), gaining full access to their data, messages, and permissions within the Rocket.Chat instance.

Mitigation & patch

Rocket.Chat must be immediately updated to version 8.3.0, 8.2.1, 8.1.2, 8.0.3, 7.13.5, 7.12.6, 7.11.6, or 7.10.9 (depending on the branch in use). As a temporary measure, consider disabling configured OAuth applications until the patch is deployed. Details available in the vendor's pull request: https://github.com/RocketChat/Rocket.Chat/pull/39492.

Who is affected

Rocket.Chat in versions: below 8.3.0, below 8.2.1, below 8.1.2, below 8.0.3, below 7.13.5, below 7.12.6, below 7.11.6, and below 7.10.9 — only when an OAuth application is configured.

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Rocket.chat
APP
Rocket.Chat
8.3.07.11.0 – 7.11.6 (excl.)7.12.0 – 7.12.6 (excl.)7.13.0 – 7.13.5 (excl.)< 7.10.98.1.0 – 8.1.2 (excl.)8.2.0 – 8.2.1 (excl.)8.0.0 – 8.0.3 (excl.)

🔵