CVE-2026-48616 Details
Description
Rocket.Chat versions <8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, 7.13.9, 7.10.13 has an access control vulnerability in Livechat files. Protected file downloads at /file-upload/:fileId/:name authorize livechat access using rc_room_type=l with rc_rid+rc_token, but the authorization path does not verify that rc_rid matches the requested file's rid. Furthermore, :fileId is predictable via sequential MongoDB IDs, and :name can be anything, allowing unauthenticated discovery of all uploaded files.
An access control vulnerability has been identified in Rocket.Chat versions prior to 8.5.1, as well as in 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, 7.13.9, and 7.10.13. The vulnerability exists in the Livechat file download authorization process. Protected files are accessed through a URL that includes a predictable file ID and a user-defined name. The authorization mechanism fails to verify that the room ID associated with the request matches the room ID of the requested file, enabling unauthorized users to access files. Additionally, the file ID can be easily guessed due to its sequential nature in MongoDB, and the name parameter can be arbitrary, facilitating the unauthorized discovery of all uploaded files.
Users can update to Rocket.Chat versions 8.5.1 or later, or 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, 7.13.9, or 7.10.13 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/RocketChat/Rocket.Chat/pull/40889 | [email protected] | Issue TrackingPatchThird Party Advisory |
| https://hackerone.com/reports/3687142 | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-284 | Improper Access Control | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| rocket.chat rocket.chat | < 7.10.13 >= 7.13.0, < 7.13.9 >= 8.0.0, < 8.0.7 >= 8.1.0, < 8.1.6 >= 8.2.0, < 8.2.6 >= 8.3.0, < 8.3.6 >= 8.4.0, < 8.4.4 >= 8.5.0, < 8.5.1 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 18, 2026 | Initial Analysis | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | New CVE Received | [email protected] |