01 Record

CVE-2026-65645

Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6. 8.3.8, 8.2.8, 8.1.8, and 7.10.15, the Meteor DDP methods getThreadsList and getThreadMessages accept rid / tmid as raw, untyped

UnratedPUBLISHEDCNA: hackerone

Base scoreUnratedNo CVSS vector published

View raw JSON CVE Program record

02 Description

Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6. 8.3.8, 8.2.8, 8.1.8, and 7.10.15, the Meteor DDP methods getThreadsList and getThreadMessages accept rid / tmid as raw, untyped

03 Metadata

Published: 2026-08-21 02:53Z22 HR AGO
Last updated: 2026-08-21 02:53Z22 HR AGO
Reserved: 2026-07-22
Assigning CNA: hackerone
Record state: PUBLISHED
Severity: Unrated: no CVSS score published
CVSS vector: Not published
Weaknesses: No CWE assigned
SSVC decision: No CISA-ADP assessment
Data version: 5.2
Document digest: 94e794bc80108a684c5fd2d726276cd3d2d87485d270d63227ea51969a6e1eea

04 Affected products

VendorProductVersionsPlatforms

Rocket.ChatRocket.Chat0 to < 8.8.0, 0 to < 8.7.1, 0 to < 8.6.2, 0 to < 8.5.3, 0 to < 8.4.6, 0 to < 8.3.8, 0 to < 8.2.8, 0 to < 8.1.8, 0 to < 7.10.15—

CVE-2026-65645

02 Description

03 Metadata

04 Affected products

05 References

02 Description

03 Metadata

04 Affected products

05 References

CVE-2026-65645

02 Description

03 Metadata

04 Affected products

05 References