CVE-2026-48616

🗓️ 16 Jun 2026 23:08:37Reported by hackeroneType

cve🔗 web.nvd.nist.gov👁 21 Views🌐 WEB

Rocket.Chat file access flaw enables unauthenticated file discovery via file-upload with missing room identifier validation and predictable file identifiers.

Reporter	Title	Published	Views	Family All 8
Circl	CVE-2026-48616	17 Jun 202600:50	–	circl
Cvelist	CVE-2026-48616	16 Jun 202623:08	–	cvelist
EUVD	EUVD-2026-37514	17 Jun 202618:35	–	euvd
Hacker One	Rocket.Chat: Unauthenticated reading of every file via livechat auth and predicting MongoDB ObjectId()	21 Apr 202614:58	–	hackerone
NVD	CVE-2026-48616	17 Jun 202613:20	–	nvd
OSV	CVE-2026-48616	16 Jun 202623:08	–	osv
Positive Technologies	PT-2026-50128	16 Jun 202600:00	–	ptsecurity
Vulnrichment	CVE-2026-48616	16 Jun 202623:08	–	vulnrichment

NVD

Vulners

Node

rocket.chat rocket.chatRange<7.10.13

rocket.chat rocket.chatRange7.13.0–7.13.9

rocket.chat rocket.chatRange8.0.0–8.0.7

rocket.chat rocket.chatRange8.1.0–8.1.6

rocket.chat rocket.chatRange8.2.0–8.2.6

rocket.chat rocket.chatRange8.3.0–8.3.6

rocket.chat rocket.chatRange8.4.0–8.4.4

rocket.chat rocket.chatRange8.5.0–8.5.1

[
  {
    "defaultStatus": "unaffected",
    "vendor": "Rocket.Chat",
    "product": "Rocket.Chat",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThan": "8.5.1",
        "versionType": "semver"
      },
      {
        "version": "0",
        "status": "affected",
        "lessThan": "8.4.4",
        "versionType": "semver"
      },
      {
        "version": "0",
        "status": "affected",
        "lessThan": "8.3.6",
        "versionType": "semver"
      },
      {
        "version": "0",
        "status": "affected",
        "lessThan": "8.2.6",
        "versionType": "semver"
      },
      {
        "version": "0",
        "status": "affected",
        "lessThan": "8.1.6",
        "versionType": "semver"
      },
      {
        "version": "0",
        "status": "affected",
        "lessThan": "8.0.7",
        "versionType": "semver"
      },
      {
        "version": "0",
        "status": "affected",
        "lessThan": "7.13.9",
        "versionType": "semver"
      },
      {
        "version": "0",
        "status": "affected",
        "lessThan": "7.10.13",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
hackerone	www.hackerone.com/reports/3687142
github	www.github.com/RocketChat/Rocket.Chat/pull/40889

Parameter	Position	Path	Description	CWE
rc_room_type	path	file-upload/:fileId/:name	Unauthorized disclosure by accessing protected livechat files due to improper verification of rc_rid against the file's rid and predictable fileId, enabling unauthenticated discovery of all uploaded files.	CWE-284
rc_rid	path	file-upload/:fileId/:name	Unauthorized disclosure by accessing protected livechat files due to improper verification of rc_rid against the file's rid and predictable fileId, enabling unauthenticated discovery of all uploaded files.	CWE-284
rc_token	path	file-upload/:fileId/:name	Unauthorized disclosure by accessing protected livechat files due to improper verification of rc_rid against the file's rid and predictable fileId, enabling unauthenticated discovery of all uploaded files.	CWE-284
fileId	path	file-upload/:fileId/:name	Unauthorized disclosure by accessing protected livechat files due to improper verification of rc_rid against the file's rid and predictable fileId, enabling unauthenticated discovery of all uploaded files.	CWE-284
name	path	file-upload/:fileId/:name	Unauthorized disclosure by accessing protected livechat files due to improper verification of rc_rid against the file's rid and predictable fileId, enabling unauthenticated discovery of all uploaded files.	CWE-284

18 Jun 2026 19:05Current

8.4High risk

Vulners AI Score8.4

CVSS 39.3

EPSS0.00304

SSVC

CWE-284