Unauthenticated File Deletion Vulnerability in Rocket.Chat by Rocket.Chat

CVE-2026-48929

What is CVE-2026-48929?

Rocket.Chat contains a vulnerability that allows attackers to delete uploaded files without authentication. The flaw exists in the deleteFileMessage Meteor method, which executes file deletions via unauthenticated DDP WebSocket connections. This oversight leaks file IDs through public messages, enabling unauthorized users to delete any file stored in the system indiscriminately.

References