Permission Check Flaw in Rocket.Chat

CVE-2026-29197

What is CVE-2026-29197?

A vulnerability exists in Rocket.Chat where certain versions contain a typo in the permission check for the endpoints /api/apps/logs and /api/apps/:id/logs. This flaw allows authenticated users to access apps-engine logs without the necessary permissions, potentially exposing sensitive information and compromising the security integrity of user data.

References