CVE-2022-35247

CVE-2022-35247 describes an information-disclosure in Rocket.Chat via the getRoomRoles Meteor method due to missing ACL checks. Affected: Rocket.Chat versions prior to 5, prior to 4.8.2, and prior to 4.7.5. The vulnerability allows an unauthorized client to leak channel members with special roles...

Rocket.Chat: getRoomRoles Method leaks Channel Owner

Summary Lack of ACL checks in the getRoomRoles Meteor method leak channel members with special roles to unauthorized clients. Description Lack of ACL checks in the getRoomRoles Meteor method allow unauthorized clients to query channel members with special roles: javascript Meteor.methods...