CVE-2026-30833

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-30833", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-05T21:06:44.606Z", "datePublished": "2026-03-06T17:40:36.939Z", "dateUpdated": "2026-03-09T14:56:03.564Z"}, "containers": {"cna": {"title": "Rocket.Chat: NoSQL injection in the EE ddp-streamer-service", "problemTypes": [{"descriptions": [{"cweId": "CWE-943", "lang": "en", "description": "CWE-943: Improper Neutralization of Special Elements in Data Query Logic", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-hgq6-9jg2-wf3f", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-hgq6-9jg2-wf3f"}], "affected": [{"vendor": "RocketChat", "product": "Rocket.Chat", "versions": [{"version": "< 7.10.8", "status": "affected"}, {"version": "< 7.11.5", "status": "affected"}, {"version": "< 7.12.5", "status": "affected"}, {"version": "< 7.13.4", "status": "affected"}, {"version": "< 8.0.2", "status": "affected"}, {"version": "< 8.1.1", "status": "affected"}, {"version": "< 8.2.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-06T17:40:36.939Z"}, "descriptions": [{"lang": "en", "value": "Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to versions 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1, and 8.2.0, a NoSQL injection vulnerability exists in Rocket.Chat's account service used in the ddp-streamer micro service that allows unauthenticated attackers to manipulate MongoDB queries during authentication. The vulnerability is located in the username-based login flow where user-supplied input is directly embedded into a MongoDB query selector without validation. An attacker can inject MongoDB operator expressions (e.g., { $regex: '.*' }) in place of a username string, causing the database query to match unintended user records. This issue has been patched in versions 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1, and 8.2.0."}], "source": {"advisory": "GHSA-hgq6-9jg2-wf3f", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-09T14:55:56.507627Z", "id": "CVE-2026-30833", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-09T14:56:03.564Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-30833", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-09T14:55:56.507627Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-09T14:55:59.509Z"}}], "cna": {"title": "Rocket.Chat: NoSQL injection in the EE ddp-streamer-service", "source": {"advisory": "GHSA-hgq6-9jg2-wf3f", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "RocketChat", "product": "Rocket.Chat", "versions": [{"status": "affected", "version": "< 7.10.8"}, {"status": "affected", "version": "< 7.11.5"}, {"status": "affected", "version": "< 7.12.5"}, {"status": "affected", "version": "< 7.13.4"}, {"status": "affected", "version": "< 8.0.2"}, {"status": "affected", "version": "< 8.1.1"}, {"status": "affected", "version": "< 8.2.0"}]}], "references": [{"url": "https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-hgq6-9jg2-wf3f", "name": "https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-hgq6-9jg2-wf3f", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to versions 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1, and 8.2.0, a NoSQL injection vulnerability exists in Rocket.Chat's account service used in the ddp-streamer micro service that allows unauthenticated attackers to manipulate MongoDB queries during authentication. The vulnerability is located in the username-based login flow where user-supplied input is directly embedded into a MongoDB query selector without validation. An attacker can inject MongoDB operator expressions (e.g., { $regex: '.*' }) in place of a username string, causing the database query to match unintended user records. This issue has been patched in versions 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1, and 8.2.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-943", "description": "CWE-943: Improper Neutralization of Special Elements in Data Query Logic"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-06T17:40:36.939Z"}}}, "cveMetadata": {"cveId": "CVE-2026-30833", "state": "PUBLISHED", "dateUpdated": "2026-03-09T14:56:03.564Z", "dateReserved": "2026-03-05T21:06:44.606Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-06T17:40:36.939Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Rocket.Chat", "vendor": "RocketChat", "versions": [{"status": "affected", "version": "< 7.10.8"}, {"status": "affected", "version": "< 7.11.5"}, {"status": "affected", "version": "< 7.12.5"}, {"status": "affected", "version": "< 7.13.4"}, {"status": "affected", "version": "< 8.0.2"}, {"status": "affected", "version": "< 8.1.1"}, {"status": "affected", "version": "< 8.2.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:*", "matchCriteriaId": "2B46CE2E-8C7D-4F11-B0CF-C73A3718A56B", "versionEndExcluding": "7.10.8", "vulnerable": true}, {"criteria": "cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:*", "matchCriteriaId": "7AF8C2C1-73C3-4FB7-889A-5A6FD8E6C6C1", "versionEndExcluding": "7.11.5", "versionStartIncluding": "7.11.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:*", "matchCriteriaId": "A7339A16-6F5B-47D2-8D6C-289E4E7DB99C", "versionEndExcluding": "7.12.5", "versionStartIncluding": "7.12.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:*", "matchCriteriaId": "87EB1237-813C-4834-89ED-52A66F3E157D", "versionEndExcluding": "7.13.4", "versionStartIncluding": "7.13.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:*", "matchCriteriaId": "F1615F6F-6774-4B2F-AA6C-ABD2397284B1", "versionEndExcluding": "8.0.2", "versionStartIncluding": "8.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:*", "matchCriteriaId": "E5C728C6-E42D-4842-8466-2ABC6151B8E8", "versionEndExcluding": "8.1.1", "versionStartIncluding": "8.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:rocket.chat:rocket.chat:8.2.0:rc0:*:*:*:*:*:*", "matchCriteriaId": "158A7899-8BF4-4BAB-ABC1-28A294BA1F3F", "vulnerable": true}, {"criteria": "cpe:2.3:a:rocket.chat:rocket.chat:8.2.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F7393A14-F640-449F-8D2E-B0E5D0734A0F", "vulnerable": true}, {"criteria": "cpe:2.3:a:rocket.chat:rocket.chat:8.2.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "57CDF8CA-080D-4E50-8758-06085FF2A95C", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to versions 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1, and 8.2.0, a NoSQL injection vulnerability exists in Rocket.Chat's account service used in the ddp-streamer micro service that allows unauthenticated attackers to manipulate MongoDB queries during authentication. The vulnerability is located in the username-based login flow where user-supplied input is directly embedded into a MongoDB query selector without validation. An attacker can inject MongoDB operator expressions (e.g., { $regex: '.*' }) in place of a username string, causing the database query to match unintended user records. This issue has been patched in versions 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1, and 8.2.0."}, {"lang": "es", "value": "Rocket.Chat es una plataforma de comunicaciones de c\u00f3digo abierto, segura y totalmente personalizable. Antes de las versiones 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1 y 8.2.0, existe una vulnerabilidad de inyecci\u00f3n NoSQL en el servicio de cuentas de Rocket.Chat utilizado en el microservicio ddp-streamer que permite a atacantes no autenticados manipular consultas de MongoDB durante la autenticaci\u00f3n. La vulnerabilidad se encuentra en el flujo de inicio de sesi\u00f3n basado en nombre de usuario, donde la entrada proporcionada por el usuario se incrusta directamente en un selector de consulta de MongoDB sin validaci\u00f3n. Un atacante puede inyectar expresiones de operador de MongoDB (por ejemplo, { $regex: '.*' }) en lugar de una cadena de nombre de usuario, lo que hace que la consulta de la base de datos coincida con registros de usuario no deseados. Este problema ha sido parcheado en las versiones 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1 y 8.2.0."}], "id": "CVE-2026-30833", "lastModified": "2026-06-17T10:32:59.740", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-30833", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-09T14:55:56.507627Z", "version": "2.0.3"}}]}, "published": "2026-03-06T18:16:22.013", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-hgq6-9jg2-wf3f"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-943"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,7.10.8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,7.11.5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,7.12.5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,7.13.4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,8.0.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,8.1.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,8.2.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Rocket.Chat", "source": "cna", "vendor": "RocketChat"}, "product": "rocket.chat", "vendor": "rocketchat"}], "analysis": {"en": {"generated_at": "2026-04-16T11:17:17.219590+00:00", "value": {"mitigation_remediation": ["Upgrade Rocket.Chat to any of the patched releases\u20147.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1, or 8.2.0\u2014or newer, ensuring that the ddp-streamer microservice is updated to the fixed version.", "Restrict or disable external access to the ddp-streamer endpoint until the application is fully upgraded, reducing the surface area for potential injection attempts.", "After patching, monitor authentication logs for anomalous login attempts that could indicate attempts to probe or exploit this vulnerability, and enforce strong input validation if custom extensions are present."], "summary": {"action": "Apply Patch", "impact": "Unauthorized Access"}, "threat_synthesis": {"affected_systems": "The affected product is Rocket.Chat (RocketChat:Rocket.Chat) in all releases prior to versions 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1, and 8.2.0. Systems running any of those earlier releases are susceptible to this NoSQL injection in the ddp-streamer service.", "description_and_impact": "Rocket.Chat is vulnerable to a NoSQL injection in the ddp-streamer microservice, allowing an unauthenticated attacker to manipulate MongoDB queries during authentication by injecting operator expressions into the username field. This flaw permits the attacker to make the database query match unintended user records, potentially granting access to other users\u2019 data or bypassing authentication. The vulnerability carries a CVSS score of 6.9, indicating moderate severity with a range of possible confidentiality impacts.", "risk_and_exploitability": "The likelihood of exploitation is low, as indicated by an EPSS score of less than 1%, and the vulnerability is not listed in CISA\u2019s Known Exploited Vulnerabilities catalog. However, because the flaw allows unauthenticated manipulation of authentication queries, attackers can potentially gain unauthorized access to user data. The moderate CVSS score reflects the potential confidentiality impact, while the minimal EPSS suggests that active exploitation is currently uncommon. Nonetheless, organizations should treat this as a moderate risk until the patch is applied."}}}}, "created": "2026-03-09T10:07:13.904766+00:00", "updated": "2026-04-16T11:30:15.894599+00:00", "vendors": ["rocketchat", "rocketchat$PRODUCT$rocket.chat"]}