Access Control Flaw in Rocket.Chat Affecting File Downloads

CVE-2026-48616

What is CVE-2026-48616?

Rocket.Chat, a popular messaging platform, has revealed an access control vulnerability in its Livechat feature across several versions. This issue allows an unauthorized user to potentially access protected files through predictable URL patterns. The flaw permits the exploitation of the authorization process that inadequately verifies whether the requested file's record ID aligns with its intended access control. Additionally, the predictable sequence of file IDs and the freedom in naming files mean that all uploaded files can be discovered without authentication. Consequently, sensitive information could be exposed to unauthorized individuals.

References