Quick answers
- Is CVE-2026-75575 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-75575 being exploited in the wild.
- How severe is CVE-2026-75575?
- Medium severity, with a CVSS score of 5.3, published 25 August 2026.
- Which products and versions are affected?
- Rocket.Chat prior to fix commit 3a61c3a.
- Is there a fix for CVE-2026-75575?
- A patch was published on 2026: Rate limit of 10 calls per minute per client address implemented Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-75575 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-75575?
- Check whether you run Rocket.Chat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The sendForgotPasswordEmail Meteor method is accessible without authentication via DDP protocol and the HTTP endpoint POST /api/v1/method.callAnon/sendForgotPasswordEmail, but lacks a DDPRateLimiter rule to restrict call frequency. An unauthenticated attacker can invoke the method unlimited times from a single source, triggering unbounded password reset emails to any target address. The method's response varies based on account state—returning true for non-existent addresses and successful sends, but false for accounts using OAuth authentication with Accounts_AllowPasswordChangeForOAuthUsers disabled—allowing attackers to enumerate account types through differential responses. The vulnerability permits both denial-of-service via email spam and account discovery at scale. Patches registered a rate limit of ten calls per minute per client address in later versions.
Affected products
- Rocket.Chat Rocket.Chat prior to fix commit 3a61c3a
Timeline
- 2026-08-25: disclosed
- 2026: patched: Rate limit of 10 calls per minute per client address implemented