Log in Start free

Vulnerability · Published Jun 24, 2026 · Assigned by GitHub_M

CVE-2026-45757Rocket.Chat: users.deactivateIdle` deactivates accounts without revoking existing login tokens

Low 2.3

In plain English

A low-severity security flaw in Rocket.Chat from RocketChat. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).

Severity (CVSS 4.0)2.3Low
Exploit odds (30 days)0.3%top 80.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12, Rocket.Chat allows users deactivated through users.deactivateIdle to keep using already-issued login tokens. A user that an administrator has marked inactive for idleness can still access authenticated REST endpoints with the old token. This vulnerability is fixed in 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12.

Affected products (as reported)

VendorProductVersions
RocketChat Rocket.Chat >= 8.5.0-rc.0, < 8.5.0>= 8.4.0-rc.0, < 8.4.2>= 8.3.0-rc.0, < 8.3.4>= 8.2.0-rc.0, < 8.2.4>= 8.1.0-rc.0, < 8.1.5>= 8.0.0-rc.0, < 8.0.6>= 7.11.0-rc.0, < 7.13.8< 7.10.12

Weakness: CWE-613 · Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References