Vulnerability · Published Jun 16, 2026 · Assigned by hackerone
CVE-2026-48929
High 7.5
In plain English
A high-severity improper authentication in Rocket.Chat from Rocket.Chat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).
Official description
Rocket.Chat in versions <8.5.1, <8.4.4, <8.3.6, <8.2.6, <8.1.6, <8.0.7, <7.13.9, and <7.10.13 is vulnerable to unauthenticated file deletion. The deleteFileMessage Meteor method permanently deletes any uploaded file by ID without requiring authentication. When called via an unauthenticated DDP WebSocket connection, Meteor.userId() returns null, causing the authorization check to be skipped. Execution falls through to FileUpload.getStore('Uploads').deleteById(fileID), which removes the file from storage and database unconditionally. File IDs are discoverable from public channel message payloads and download URLs.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Rocket.Chat | Rocket.Chat | 0 – before 8.5.10 – before 8.4.40 – before 8.3.60 – before 8.2.60 – before 8.1.60 – before 8.0.70 – before 7.13.90 – before 7.10.13 |
Weakness: CWE-287 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H