Incorrect Authorization Information Disclosure in Rocket.Chat by Rocket.Chat

CVE-2025-7974

What is CVE-2025-7974?

This vulnerability in Rocket.Chat allows remote attackers to exploit incorrect authorization mechanisms, leading to potential disclosure of sensitive information without the need for authentication. The web service, which normally listens on TCP port 3000, is particularly susceptible as it exposes critical data in the application context. Attackers could leverage this flaw to gain unauthorized access to sensitive information, posing significant security risks to users of affected installations.

References