CVE-2026-30831 Details
Description
Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to versions 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1, and 8.2.0, authentication vulnerabilities exist in Rocket.Chat's enterprise DDP Streamer service. The Account.login method exposed through the DDP Streamer does not enforce Two-Factor Authentication (2FA) or validate user account status (deactivated users can still login), despite these checks being mandatory in the standard Meteor login flow. This issue has been patched in versions 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1, and 8.2.0.
An authentication vulnerability has been identified in Rocket.Chat's enterprise DDP Streamer service, prior to versions 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1, and 8.2.0. The vulnerability arises because the Account.login method in the DDP Streamer does not enforce Two-Factor Authentication (2FA) or validate the status of user accounts, allowing deactivated users to log in. These checks are mandatory in the standard Meteor login process. The issue could lead to account takeovers, as the lack of 2FA could be exploited through brute-force attacks, such as password spraying.
Users should update to Rocket.Chat versions 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1, or 8.2.0. After updating, ensure that the Account.login method in the DDP Streamer enforces 2FA and validates user account status, rejecting logins for deactivated users.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-7qr6-q62g-hm63 | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
| CWE-304 | Missing Critical Step in Authentication | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| rocket.chat rocket.chat | < 7.10.8 >= 7.11.0, < 7.11.5 >= 7.12.0, < 7.12.5 >= 7.13.0, < 7.13.4 >= 8.0.0, < 8.0.2 >= 8.1.0, < 8.1.1 8.2.0 rc0 8.2.0 rc1 8.2.0 rc2 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 13, 2026 | Initial Analysis | [email protected] |
| Mar 6, 2026 | New CVE Received | [email protected] |