Improper Input Validation in Rocket.Chat Affects Multiple Versions

CVE-2026-65645

What is CVE-2026-65645?

Rocket.Chat versions prior to 8.8.0 exhibit a serious vulnerability where the Meteor DDP methods getThreadsList and getThreadMessages accept raw, untyped parameters without schema validation. Attackers can exploit this flaw by substituting MongoDB operator objects (e.g., {'$gt': '4'}) for expected string room or message identifiers. Due to inadequate authorization checks, low-privileged authenticated users may access private thread data, revealing sensitive information such as thread parents and their replies. While a patch was implemented for the REST route chat.getThreadsList in version 5.0, the corresponding DDP method exploitation remains unaddressed, posing a significant security risk.

References