Executive brief
A security flaw in Rocket.Chat, a popular team communication platform, allows users to read messages they are not authorized to see. By exploiting a weakness in the message translation feature, an authenticated user can access private conversations, direct messages, and even encrypted rooms across the entire organization. This could lead to the exposure of sensitive business data and confidential employee communications.
Technical details
An improper access control vulnerability (CWE-284) exists in the Rocket.Chat DDP method 'autoTranslate.translateMessage'. The method accepts a client-supplied 'IMessage' object and passes it to the translation logic without verifying the 'Meteor.userId()' or checking if the requesting user has membership in the room associated with the message. An authenticated attacker can exploit this by calling the method with a specific message ID to retrieve the content of any message, bypassing restrictions for private channels, direct messages (DMs), and end-to-end encrypted (E2EE) rooms. The issue is resolved in versions 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.5, 7.13.8, and 7.10.12.
Affected products
- Rocket.Chat Rocket.Chat < 8.5.0, < 8.4.2, < 8.3.4, < 8.2.4, < 8.1.5, < 8.0.5, < 7.13.8, < 7.10.12
Timeline
- 2026-05-14: patched: Fix merged into Rocket.Chat repository
- 2026-05-28: advisory: CVE published by NVD/HackerOne