CVE-2022-32220

An information disclosure vulnerability exists in Rocket.Chat <v5 due to the getUserMentionsByChannel meteor server method discloses messages from private channels and direct messages regardless of the users access permission to the room.

• CWE-200
• CWE-862
• CWE-200

• https://hackerone.com/reports/1410246Exploit, Issue Tracking, Mitigation, Third Party Advisory
• https://hackerone.com/reports/1410246Exploit, Issue Tracking, Mitigation, Third Party Advisory

Published

Sep 23, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-32214The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the h…6.5
• CVE-2022-32215The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the h…6.5
• CVE-2022-32217A cleartext storage of sensitive information exists in Rocke…5.3
• CVE-2022-32218An information disclosure vulnerability exists in Rocket.Cha…4.3
• CVE-2022-32219An information disclosure vulnerability exists in Rocket.Cha…4.3
• CVE-2022-3222Uncontrolled Recursion in GitHub repository gpac/gpac prior …5.5
• CVE-2022-32221When doing HTTP(S) transfers, libcurl might erroneously use …9.8
• CVE-2022-32222A cryptographic vulnerability exists on Node.js on linux in …5.3
• CVE-2022-32223Node.js is vulnerable to Hijack Execution Flow: DLL Hijackin…7.3
• CVE-2022-32224A possible escalation to RCE vulnerability exists when using…9.8
• CVE-2022-32225A reflected DOM-Based XSS vulnerability has been discovered …6.1
• CVE-2022-32226An improper access control vulnerability exists in Rocket.Ch…4.3