PT-2026-52098 · Rocket.Chat · Rocket.Chat

Publicado 2026-06-24 · Atualizado 2026-06-24 · CVE-2026-49277

Mitre

CVSS v4.0

2.3

Baixa

Vetor base

AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12, Rocket.Chat does not revoke OAuth bearer or refresh tokens when a user is deactivated. A deactivated user can continue using an existing OAuth access token, and can also mint a fresh access token from an existing refresh token. This vulnerability is fixed in 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12.

Correção

Insufficient Session Expiration

Enumeração de Fraquezas

CWE-613

Identificadores relacionados

CVE-2026-49277

Produtos afetados

Rocket.Chat

Referências · 2

• https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-39hg-492f-3c4f · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-49277 · Nota de Segurança