Vulnerability in Rocket.Chat’s AutoTranslate Feature Allows Message Disclosure

CVE-2026-32995

What is CVE-2026-32995?

A security flaw exists in Rocket.Chat's autoTranslate.translateMessage function, found in multiple older versions, where it accepts a user-provided IMessage object without appropriate checks. This oversight allows any authenticated DDP user to access message contents from any room, including private channels and end-to-end encrypted messages, potentially leading to unauthorized information exposure.

References