PT-2026-23737 · Rocket.Chat · Rocket.Chat

P- · Published 2026-03-06 · Updated 2026-03-13 · CVE-2026-30831

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Rocket.Chat versions prior to 7.10.8 Rocket.Chat versions prior to 7.11.5 Rocket.Chat versions prior to 7.12.5 Rocket.Chat versions prior to 7.13.4 Rocket.Chat versions prior to 8.0.2 Rocket.Chat versions prior to 8.1.1 Rocket.Chat versions prior to 8.2.0

Description Rocket.Chat is a communications platform. Authentication issues exist in the enterprise DDP Streamer service. The Account.login method, exposed through the DDP Streamer, does not enforce Two-Factor Authentication (2FA) or validate user account status, allowing deactivated users to log in. These checks are normally required in the standard Meteor login process.

Recommendations Update to Rocket.Chat version 7.10.8 or later. Update to Rocket.Chat version 7.11.5 or later. Update to Rocket.Chat version 7.12.5 or later. Update to Rocket.Chat version 7.13.4 or later. Update to Rocket.Chat version 8.0.2 or later. Update to Rocket.Chat version 8.1.1 or later. Update to Rocket.Chat version 8.2.0 or later.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

CWE-304

Related Identifiers

CVE-2026-30831

GHSA-7QR6-Q62G-HM63

Affected Products

Rocket.Chat

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30831.json · Exploit
• https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-7qr6-q62g-hm63 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-30831 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30831 · Security Note
• https://t.me/cveNotify/155458 · Telegram Post
• https://t.me/CVEtracker/46637 · Telegram Post