CVE-2026-72918

Summary

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1, the stream-notify-user stream in the WebSocket protocol allows an authenticated user to write arbitrary notification bodies because the sender is not checked, and the client-side UI can create an ephemeral fake message in another user's currently open chat. This issue is fixed in versions 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1.

Affected Software

VendorProductVersion RangeStatus
RocketChatRocket.Chat< 7.10.14affected
RocketChatRocket.Chat>= 8.0.0, < 8.0.8affected
RocketChatRocket.Chat>= 8.1.0, < 8.1.7affected
RocketChatRocket.Chat>= 8.2.0, < 8.2.7affected
RocketChatRocket.Chat>= 8.3.0, < 8.3.7affected
RocketChatRocket.Chat>= 8.4.0, < 8.4.5affected
RocketChatRocket.Chat>= 8.5.0, < 8.5.2affected
RocketChatRocket.Chat>= 8.6.0, < 8.6.1affected

Weaknesses

  • CWE-862: CWE-862: Missing Authorization

References