Authorization Bypass in Rocket.Chat Affects Multiple Versions
CVE-2026-72919
4.3MEDIUM
What is CVE-2026-72919?
Rocket.Chat has a vulnerability that allows authenticated users with specific permissions to manipulate public channels through the channels.convertToTeam REST endpoint. The flaw arises because the security check for modifying the channel only validates the channelId, while an attacker can exploit the channelName parameter to convert unrelated public channels. Users are encouraged to update to the latest versions, which address this security oversight.
Affected Version(s)
Rocket.Chat < 7.10.14 < 7.10.14
Rocket.Chat >= 8.0.0, < 8.0.8 < 8.0.0, 8.0.8
Rocket.Chat >= 8.1.0, < 8.1.7 < 8.1.0, 8.1.7