Executive brief
Rocket.Chat is a customizable communications platform used for team collaboration and messaging. A security flaw allows any registered user, regardless of their permission level, to disconnect the entire organization's workspace from the Rocket.Chat Cloud. This action immediately disables paid features, wipes license information, and breaks mobile push notifications for all users, requiring manual administrative intervention to restore services.
Technical details
A missing authorization check (CWE-862) exists in the 'POST /api/v1/fingerprint' REST endpoint within 'apps/meteor/app/api/server/v1/misc.ts'. While the endpoint requires authentication, it fails to verify if the user has administrative permissions (such as 'manage-cloud'). An attacker with standard user privileges can send a request with the 'setDeploymentAs' parameter set to 'new-workspace', triggering a routine that clears 'Cloud_Workspace_Id', 'Cloud_Workspace_License', and other critical cloud credentials. This results in a loss of integrity and availability for cloud-dependent features. The issue is resolved in versions 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13.
Affected products
- RocketChat Rocket.Chat < 8.5.1, < 8.4.4, < 8.3.6, < 8.2.6, < 8.1.6, < 8.0.7, < 7.10.13
Timeline
- 2026-06-15: advisory: GitHub advisory published by Rocket.Chat
- 2026-06-24: disclosed: NVD publication date