Executive brief
Rocket.Chat, a popular communication and collaboration platform, is vulnerable to a flaw that allows anyone on the internet to permanently delete uploaded files without logging in. An attacker can identify file IDs from public channels or download links and delete them, leading to permanent data loss and disruption of business operations. This issue affects various versions of the software and has been addressed in recent security updates.
Technical details
Rocket.Chat is vulnerable to unauthenticated file deletion due to an improper authentication check in the 'deleteFileMessage' Meteor method. When the method is invoked via an unauthenticated DDP WebSocket connection, 'Meteor.userId()' returns null, which inadvertently causes the authorization logic to be bypassed. The execution then proceeds to 'FileUpload.getStore('Uploads').deleteById(fileID)', resulting in the unconditional removal of the file from both storage and the database. Attackers can discover target file IDs through public channel message payloads or download URLs. The vulnerability is fixed in versions 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, 7.13.9, and 7.10.13.
Affected products
- Rocket.Chat Rocket.Chat <8.5.1, <8.4.4, <8.3.6, <8.2.6, <8.1.6, <8.0.7, <7.13.9, <7.10.13
Timeline
- 2026-06-11: patched: Fix merged into develop branch via PR 40889
- 2026-06-17: disclosed: Vulnerability published to NVD