NoSQL Injection Vulnerability in Rocket.Chat by Rocket.Chat

CVE-2026-29198

What is CVE-2026-29198?

Rocket.Chat versions prior to 8.3.0 exhibit a vulnerability that allows an attacker to perform NoSQL injection. This can lead to the unauthorized takeover of accounts, specifically targeting the initial user when an OAuth application is integrated. The flaw arises when user-generated tokens are processed without proper validation, potentially exposing sensitive data and user accounts. Organizations utilizing these versions should assess their security posture and apply appropriate patches to mitigate the risk.

References