CVE-2026-65645

Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6. 8.3.8, 8.2.8, 8.1.8, and 7.10.15, the Meteor DDP methods getThreadsList and getThreadMessages accept rid / tmid as raw, untyped parameters with no schema validation. A MongoDB operator object (e.g. {"$gt": "4"}) can be substituted for a string room-id or message-id. The authorization check resolves to a room the attacker already has access to, while the downstream data query fans out across all rooms - disclosing private thread parents and their full reply content to any low-privilege authenticated user. The REST route chat.getThreadsList was patched in v5.0 (HackerOne report #1446767) by adding rid: {type:'string'} AJV validation. The equivalent DDP method was never given the same fix and remains exploitable

• CWE-20

• https://github.com/RocketChat/Rocket.Chat/pull/41814Patch, Vendor Advisory
• https://hackerone.com/reports/3852135Third Party Advisory, Issue Tracking

Published

Aug 21, 2026

Last Modified

Sep 4, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-6564A vulnerability was found in EMQ EMQX Enterprise up to 6.1.0…4.3
• CVE-2026-65640WordPress is vulnerable to a remote code execution vulnerabi…8.8
• CVE-2026-65641A vulnerability allowing an unauthenticated network attacker…9.3
• CVE-2026-65642Insecure direct object reference in Plesk 18.0.79.7 and earl…8.6
• CVE-2026-65643Eval injection in cPanel 11.138.0.0 and earlier allows remot…8.8
• CVE-2026-65644Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8…7.5
• CVE-2026-65646Improper neutralization of special elements in in Plesk's DN…9.9
• CVE-2026-65647Improper symlink resolution before file access in Plesk allo…8.7
• CVE-2026-6565The Style Kits – Advanced Theme Styles for Elementor, Elemen…6.4
• CVE-2026-65650Elgg before 7.0.0 does not check image dimensions to prevent…4.3
• CVE-2026-65651temporalio/sqlparser accepts SQL containing deeply nested un…8.7
• CVE-2026-65652github.com/temporalio/tchannel-go did not validate the one-b…8.7