Vulnerability · Published Aug 10, 2026 · Assigned by GitHub_M

CVE-2026-72918Rocket.Chat: Insecure implementation of websocket notifications

Medium 5.4

In plain English

A medium-severity missing authorization in Rocket.Chat from RocketChat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.2%top 86.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1, the stream-notify-user stream in the WebSocket protocol allows an authenticated user to write arbitrary notification bodies because the sender is not checked, and the client-side UI can create an ephemeral fake message in another user's currently open chat. This issue is fixed in versions 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1.

Affected products (as reported)

Vendor	Product	Versions
RocketChat	Rocket.Chat	< 7.10.14>= 8.0.0, < 8.0.8>= 8.1.0, < 8.1.7>= 8.2.0, < 8.2.7>= 8.3.0, < 8.3.7>= 8.4.0, < 8.4.5>= 8.5.0, < 8.5.2>= 8.6.0, < 8.6.1

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References

https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-27jx-236m-3f5j x_refsource_CONFIRM