CVE-2026-55762

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13, the POST /api/v1/fingerprint REST endpoint enforces authentication (authRequired: true) but performs no authorization check. Any authenticated user — including a standard user role account — can call this endpoint with {"setDeploymentAs": "new-workspace"} to permanently deregister the workspace from Rocket.Chat Cloud. This wipes all cloud credentials, removes the workspace license, breaks push notifications for all users, and requires manual re-registration to recover. This vulnerability is fixed in 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13.

• CWE-862

• https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-8hhc-j325-rxqp

Published

Jun 24, 2026

Last Modified

Jun 25, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55748OpenStack Horizon before 25.7.4 produces scripts for OpenSta…6
• CVE-2026-5575A vulnerability was detected in SourceCodester/jkev Record M…7.3
• CVE-2026-55759Rocket.Chat is an open-source, secure, fully customizable co…7.4
• CVE-2026-5576A flaw has been found in SourceCodester/jkev Record Manageme…4.7
• CVE-2026-55760Handlebars.java provides logic-less and semantic Mustache te…7.5
• CVE-2026-55761Portainer Community Edition is a lightweight service deliver…5.9
• CVE-2026-55766guzzlehttp/psr7 is a PSR-7 HTTP message library implementati…4.8
• CVE-2026-55767Guzzle is an extensible PHP HTTP client. Prior to 7.12.1, Co…5.8
• CVE-2026-55768GoAccess is a real-time web log analyzer and interactive vie…8.7
• CVE-2026-5577A vulnerability has been found in Song-Li cross_browser up t…8.6
• CVE-2026-55771CedarJava is an open source Java implementation of the Cedar…8.8
• CVE-2026-55772CedarJava is an open source Java implementation of the Cedar…8.8