Message Retrieval Flaw in Popular Chat Application by Vendor

CVE-2026-32994

What is CVE-2026-32994?

A significant security issue has been identified in the chat application where the /api/v1/autotranslate.translateMessage endpoint allows any authenticated user to access the full contents of messages from private groups, direct messages, and public channels. This issue arises due to a lack of necessary room access verification when fetching messages, which exposes sensitive information, including message text, sender details, room IDs, timestamps, and markdown content, by merely providing a message ID. Immediate action is recommended to secure the application against potential exploitation.

References