Executive brief
Rocket.Chat is a team collaboration platform with messaging and thread features. A flaw in the Meteor DDP protocol methods for retrieving thread lists allows authenticated users without proper authorization to view private threads and messages from rooms they do not have access to, exposing sensitive team communications.
Technical details
The vulnerability is an authorization bypass and information disclosure in the Meteor DDP methods getThreadsList and getThreadMessages. These methods accept rid (room ID) and tmid (thread message ID) parameters as raw, untyped inputs with no schema validation, allowing a MongoDB operator object (e.g. {"$gt": "4"}) to be injected in place of a string identifier. The authorization check resolves to a room the attacker already has access to, but the downstream data query fans out across all rooms, disclosing private thread parents and their full reply content. An authenticated attacker with low-privilege access can exploit this via network to retrieve unauthorized thread data. The REST API equivalent (chat.getThreadsList) was patched in v5.0 with AJV type validation, but the DDP methods were never given the same fix.
Affected products
- Rocket.Chat Rocket.Chat before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, and 7.10.15
Timeline
- 2026-08-21: disclosed
- 2026-08-18: patched: Fixes imported in PR #41814