Log in Start free

Vulnerability · Published Jun 24, 2026 · Assigned by GitHub_M

CVE-2026-49277Rocket.Chat: OAuth access and refresh tokens remain valid after account deactivation

Low 2.3

In plain English

A low-severity security flaw in Rocket.Chat from RocketChat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 4.0)2.3Low
Exploit odds (30 days)0.3%top 75.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12, Rocket.Chat does not revoke OAuth bearer or refresh tokens when a user is deactivated. A deactivated user can continue using an existing OAuth access token, and can also mint a fresh access token from an existing refresh token. This vulnerability is fixed in 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12.

Affected products (as reported)

VendorProductVersions
RocketChat Rocket.Chat >= 8.5.0-rc.0, < 8.5.0>= 8.4.0-rc.0, < 8.4.2>= 8.3.0-rc.0, < 8.3.4>= 8.2.0-rc.0, < 8.2.4>= 8.1.0-rc.0, < 8.1.5>= 8.0.0-rc.0, < 8.0.6>= 7.11.0-rc.0, < 7.13.8< 7.10.12

Weakness: CWE-613 · Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References