CVE-2026-48929

Rocket.Chat in versions <8.5.1, <8.4.4, <8.3.6, <8.2.6, <8.1.6, <8.0.7, <7.13.9, and <7.10.13 is vulnerable to unauthenticated file deletion. The deleteFileMessage Meteor method permanently deletes any uploaded file by ID without requiring authentication. When called via an unauthenticated DDP WebSocket connection, Meteor.userId() returns null, causing the authorization check to be skipped. Execution falls through to FileUpload.getStore('Uploads').deleteById(fileID), which removes the file from storage and database unconditionally. File IDs are discoverable from public channel message payloads and download URLs.

• CWE-287

• https://github.com/RocketChat/Rocket.Chat/pull/40889/Issue Tracking, Patch, Third Party Advisory
• https://hackerone.com/reports/3611837Third Party Advisory

Published

Jun 17, 2026

Last Modified

Jun 18, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-48923Jenkins AppSpider Plugin 1.0.17 and earlier does not perform…4.3
• CVE-2026-48924Jenkins Bitbucket OAuth Plugin 0.17 and earlier does not res…4.3
• CVE-2026-48925A cross-site request forgery (CSRF) vulnerability in Jenkins…4.3
• CVE-2026-48926Jenkins Job Import Plugin 143.v044a_2e819b_27 and earlier do…4.3
• CVE-2026-48927Jenkins buildgraph-view Plugin 1.8 and earlier does not esca…5.5
• CVE-2026-48928A inconsistency in Node.js hostname matching can cause a tru…5.4
• CVE-2026-4893An information disclosure vulnerability in dnsmasq allows re…5.3
• CVE-2026-48930A flaw in Node.js TLS hostname handling can cause Embedded-n…9.8
• CVE-2026-48931A flaw in Node.js HTTP Agent can cause a client to accept as…3.7
• CVE-2026-48933A flaw in Node.js WebCrypto implementation can crash the pro…7.5
• CVE-2026-48934A flaw in Node.js TLS host verification can cause an attacke…4.3
• CVE-2026-48935A flaw in Node.js Permission API can cause a file metadata t…3.3