CVE-2026-72919

Rocket.Chat prior to versions 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1 exposes a broken access control in the channels.convertToTeam REST endpoint. An authenticated user with the create-team permission could convert an unrelated public channel by providing channelName instead ...