01 Record

CVE-2026-65644

Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, and 7.10.15 has a REST API endpoint POST /api/v1/livechat/visitor that accepts an unauthenticated, unsanitized

UnratedPUBLISHEDCNA: hackerone

Base scoreUnratedNo CVSS vector published

View raw JSON CVE Program record

02 Description

Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, and 7.10.15 has a REST API endpoint POST /api/v1/livechat/visitor that accepts an unauthenticated, unsanitized

03 Metadata

Published

2026-08-21 02:53Z22 HR AGO

Last updated

2026-08-21 02:53Z22 HR AGO

Reserved

2026-07-22

Assigning CNA

hackerone

Record state

PUBLISHED

Severity

Unrated: no CVSS score published

CVSS vector

Not published

Weaknesses

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Base

SSVC decision

No CISA-ADP assessment

Data version

5.2

Document digest

03eeb9b0d5e8822cac74d060ff759aba2063d43d8de7a6b95bbba3500da2ee58

04 Affected products

VendorProductVersionsPlatforms

Rocket.ChatRocket.Chat0 to < 8.8.0, 0 to < 8.7.1, 0 to < 8.6.2, 0 to < 8.5.3, 0 to < 8.4.6, 0 to < 8.3.8, 0 to < 8.2.8, 0 to < 8.1.8, 0 to < 7.10.15—

CVE-2026-65644

02 Description

03 Metadata

04 Affected products

05 References

02 Description

03 Metadata

04 Affected products

05 References

CVE-2026-65644

02 Description

03 Metadata

04 Affected products

05 References