Unrestricted Password Reset Method Vulnerability in Rocket.Chat

CVE-2026-75575

What is CVE-2026-75575?

Rocket.Chat has a vulnerability in its password reset mechanism that exposes the 'sendForgotPasswordEmail' method without a rate limiter for DDP communications. This oversight allows an unauthenticated user to repeatedly trigger password reset emails for any registered account, potentially leading to spam or account enumeration. The method can be accessed via both DDP and the HTTP endpoint, allowing attackers to probe numerous addresses. While later patches introduce a rate limiting feature that restricts calls to ten per minute for each client, prior versions remain vulnerable to mass exploitation due to this lack of control.

References