Rocket.Chat getUserMentionsByChannel meteor server authorization issues vulnerability

Rocket.Chat is an open source team chat software. A vulnerability exists in Rocket.Chat prior to version 5.0 due to an authorization issue, which stems from a leak in the getUserMentionsByChannel meteor server method that can be exploited by an attacker to obtain sensitive information...

CVE-2022-35249

A information disclosure vulnerability exists in Rocket.Chat v5 where the getUserMentionsByChannel meteor server method discloses messages from private channels and direct messages regardless of the users access permission to the room...

CVE-2022-35249

A information disclosure vulnerability exists in Rocket.Chat v5 where the getUserMentionsByChannel meteor server method discloses messages from private channels and direct messages regardless of the users access permission to the room...

Information disclosure

A information disclosure vulnerability exists in Rocket.Chat v5 where the getUserMentionsByChannel meteor server method discloses messages from private channels and direct messages regardless of the users access permission to the room...

CVE-2022-32220

An information disclosure vulnerability exists in Rocket.Chat v5 due to the getUserMentionsByChannel meteor server method discloses messages from private channels and direct messages regardless of the users access permission to the room...

PT-2022-22656 · Unknown · Rocket.Chat

Name of the Vulnerable Software and Affected Versions: Rocket.Chat versions prior to 5 Description: A information disclosure issue exists where the getUserMentionsByChannel meteor server method discloses messages from private channels and direct messages regardless of the user's access permission...

Rocket.Chat: getUserMentionsByChannel leaks messages with mention from private channel

Summary The getUserMentionsByChannel meteor server method discloses messages from private channels and direct messages regardless of the users access permission to the room. Description When calling the getUserMentionsByChannel method, the server does not check the users access to the given room...