Vulnerability · Published Aug 25, 2026 · Assigned by VulnCheck
CVE-2026-75575Rocket.Chat Missing DDP Rate Limit on the sendForgotPasswordEmail Meteor Method
Medium 5.3
In plain English
A medium-severity security flaw in Rocket.Chat from RocketChat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).
Official description
Rocket.Chat exposes the sendForgotPasswordEmail Meteor method without a DDP rate limit, so an unauthenticated caller may invoke it as often as it likes. The method is reachable over DDP and over the HTTP route POST /api/v1/method.callAnon/sendForgotPasswordEmail, and it triggers a password reset message for any address that matches an account. With no DDPRateLimiter rule registered for it, a caller can drive an unbounded volume of reset mail at a chosen address from the deployment's own mail sender, and can probe addresses at scale: the method answers true for an address with no account and for a successful send, but false when the address belongs to an account that authenticates through an external provider and Accounts_AllowPasswordChangeForOAuthUsers is off, so repeated calls distinguish that class of account. Later versions register a rule permitting ten calls per minute per client address.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| RocketChat | Rocket.Chat | 0 – before 7.10.158.0.0 – before 8.1.88.2.0 – before 8.2.88.3.0 – before 8.3.88.4.0 – before 8.4.68.5.0 – before 8.5.38.6.0 – before 8.6.28.7.0 – before 8.7.2 |
Weakness: CWE-307, CWE-204 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N