CVEvulnerability

CVE-2026-30831

8.0 HIGH Published 2026-03-06 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2026-03-06
Last modified
2026-06-17
Assigner
[email protected]
CVSS 4.0 ([email protected])
8.0 HIGH — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-287, CWE-304

Description

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to versions 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1, and 8.2.0, authentication vulnerabilities exist in Rocket.Chat's enterprise DDP Streamer service. The Account.login method exposed through the DDP Streamer does not enforce Two-Factor Authentication (2FA) or validate user account status (deactivated users can still login), despite these checks being mandatory in the standard Meteor login flow. This issue has been patched in versions 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1, and 8.2.0.

Affected configurations

• rocket.chat rocket.chat (< 7.10.8) • rocket.chat rocket.chat (>= 7.11.0 < 7.11.5) • rocket.chat rocket.chat (>= 7.12.0 < 7.12.5) • rocket.chat rocket.chat (>= 7.13.0 < 7.13.4) • rocket.chat rocket.chat (>= 8.0.0 < 8.0.2) • rocket.chat rocket.chat (>= 8.1.0 < 8.1.1) • rocket.chat rocket.chat 8.2.0

Related

Weakness · CWE (2)

  • CWE-287 Improper Authentication weakness
  • CWE-304 Missing Critical Step in Authentication weakness

References