CVE-2026-30833 Details
Description
Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to versions 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1, and 8.2.0, a NoSQL injection vulnerability exists in Rocket.Chat's account service used in the ddp-streamer micro service that allows unauthenticated attackers to manipulate MongoDB queries during authentication. The vulnerability is located in the username-based login flow where user-supplied input is directly embedded into a MongoDB query selector without validation. An attacker can inject MongoDB operator expressions (e.g., { $regex: '.*' }) in place of a username string, causing the database query to match unintended user records. This issue has been patched in versions 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1, and 8.2.0.
A NoSQL injection vulnerability has been identified in Rocket.Chat's account service within the ddp-streamer microservice. This vulnerability, present in versions prior to 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1, and 8.2.0, allows unauthenticated attackers to manipulate MongoDB queries during the username-based login process. User input is directly inserted into a MongoDB query selector without proper validation, enabling attackers to inject MongoDB operator expressions, such as regular expressions, to match unintended user records. The issue arises because the username parameter is used in a database query without type or content validation, creating a potential for unauthorized access by exploiting the injection flaw.
Users are advised to validate the username parameter as a primitive string before incorporating it into database queries. Alternatively, parameterized queries should be used when possible.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-hgq6-9jg2-wf3f | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-943 | Improper Neutralization of Special Elements in Data Query Logic | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| rocket.chat rocket.chat | < 7.10.8 >= 7.11.0, < 7.11.5 >= 7.12.0, < 7.12.5 >= 7.13.0, < 7.13.4 >= 8.0.0, < 8.0.2 >= 8.1.0, < 8.1.1 8.2.0 rc0 8.2.0 rc1 8.2.0 rc2 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 13, 2026 | Initial Analysis | [email protected] |
| Mar 6, 2026 | New CVE Received | [email protected] |