Home

Description

The Rocket.Chat DDP method autoTranslate.translateMessage in versions <8.5.0, <8.4.2, <8.3.4, <8.2.4, <8.1.5, <8.0.5, <7.13.8, and <7.10.12 accepts a client-supplied IMessage object and passes it directly to translateMessage() without checking Meteor.userId() or verifying room membership. Any authenticated DDP user can read the content of any message by ID from any room (private channels, DMs, E2EE rooms) by calling this method.

PUBLISHED Reserved 2026-03-17 | Published 2026-05-28 | Updated 2026-05-28 | Assigner hackerone




HIGH: 7.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Problem types

CWE-284 Improper Access Control - Generic

Product status

Default status
unaffected

8.5.0 (semver) before 8.5.0
affected

8.4.0 (semver) before 8.4.2
affected

8.3.0 (semver) before 8.3.4
affected

8.2.0 (semver) before 8.2.4
affected

8.1.0 (semver) before 8.1.5
affected

8.0.0 (semver) before 8.0.6
affected

7.13.0 (semver) before 7.13.8
affected

7.10.0 (semver) before 7.10.12
affected

References

hackerone.com/reports/3734326

github.com/RocketChat/Rocket.Chat/pull/40528

cve.org (CVE-2026-32995)

nvd.nist.gov (CVE-2026-32995)

Download JSON