CVE-2026-45687

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-45687", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-13T04:38:01.164Z", "datePublished": "2026-06-24T20:55:25.918Z", "dateUpdated": "2026-06-26T18:43:50.524Z"}, "containers": {"cna": {"title": "Rocket.Chat: Authenticated Arbitrary Data Export Theft via Mass Assignment in sendFileMessage", "problemTypes": [{"descriptions": [{"cweId": "CWE-915", "lang": "en", "description": "CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-fhc2-x8cp-c5ch", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-fhc2-x8cp-c5ch"}], "affected": [{"vendor": "RocketChat", "product": "Rocket.Chat", "versions": [{"version": ">= 8.5.0-rc.0, < 8.5.0", "status": "affected"}, {"version": ">= 8.4.0-rc.0, < 8.4.1", "status": "affected"}, {"version": ">= 8.3.0-rc.0, < 8.3.3", "status": "affected"}, {"version": ">= 8.2.0-rc.0, < 8.2.3", "status": "affected"}, {"version": ">= 8.1.0-rc.0, < 8.1.4", "status": "affected"}, {"version": ">= 8.0.0-rc.0, < 8.0.5", "status": "affected"}, {"version": ">= 7.11.0-rc.0, < 7.13.7", "status": "affected"}, {"version": "< 7.10.11", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-24T20:55:25.918Z"}, "descriptions": [{"lang": "en", "value": "Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11, Rocket.Chat's sendFileMessage DDP method passes the entire attacker-supplied file object into Uploads.updateFileComplete, which merges it directly into a MongoDB $set update via Object.assign. There is no allow-list of writable fields. An attacker can therefore rewrite any column on their own upload record, notably store and the store-specific path fields. This vulnerability is fixed in 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11."}], "source": {"advisory": "GHSA-fhc2-x8cp-c5ch", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-26T17:51:10.359261Z", "id": "CVE-2026-45687", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-26T18:43:50.524Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-45687", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-26T17:51:10.359261Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-26T17:51:11.582Z"}}], "cna": {"title": "Rocket.Chat: Authenticated Arbitrary Data Export Theft via Mass Assignment in sendFileMessage", "source": {"advisory": "GHSA-fhc2-x8cp-c5ch", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "RocketChat", "product": "Rocket.Chat", "versions": [{"status": "affected", "version": ">= 8.5.0-rc.0, < 8.5.0"}, {"status": "affected", "version": ">= 8.4.0-rc.0, < 8.4.1"}, {"status": "affected", "version": ">= 8.3.0-rc.0, < 8.3.3"}, {"status": "affected", "version": ">= 8.2.0-rc.0, < 8.2.3"}, {"status": "affected", "version": ">= 8.1.0-rc.0, < 8.1.4"}, {"status": "affected", "version": ">= 8.0.0-rc.0, < 8.0.5"}, {"status": "affected", "version": ">= 7.11.0-rc.0, < 7.13.7"}, {"status": "affected", "version": "< 7.10.11"}]}], "references": [{"url": "https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-fhc2-x8cp-c5ch", "name": "https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-fhc2-x8cp-c5ch", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11, Rocket.Chat's sendFileMessage DDP method passes the entire attacker-supplied file object into Uploads.updateFileComplete, which merges it directly into a MongoDB $set update via Object.assign. There is no allow-list of writable fields. An attacker can therefore rewrite any column on their own upload record, notably store and the store-specific path fields. This vulnerability is fixed in 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-915", "description": "CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-24T20:55:25.918Z"}}}, "cveMetadata": {"cveId": "CVE-2026-45687", "state": "PUBLISHED", "dateUpdated": "2026-06-26T18:43:50.524Z", "dateReserved": "2026-05-13T04:38:01.164Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-24T20:55:25.918Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Rocket.Chat", "vendor": "RocketChat", "versions": [{"status": "affected", "version": ">= 8.5.0-rc.0, < 8.5.0"}, {"status": "affected", "version": ">= 8.4.0-rc.0, < 8.4.1"}, {"status": "affected", "version": ">= 8.3.0-rc.0, < 8.3.3"}, {"status": "affected", "version": ">= 8.2.0-rc.0, < 8.2.3"}, {"status": "affected", "version": ">= 8.1.0-rc.0, < 8.1.4"}, {"status": "affected", "version": ">= 8.0.0-rc.0, < 8.0.5"}, {"status": "affected", "version": ">= 7.11.0-rc.0, < 7.13.7"}, {"status": "affected", "version": "< 7.10.11"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11, Rocket.Chat's sendFileMessage DDP method passes the entire attacker-supplied file object into Uploads.updateFileComplete, which merges it directly into a MongoDB $set update via Object.assign. There is no allow-list of writable fields. An attacker can therefore rewrite any column on their own upload record, notably store and the store-specific path fields. This vulnerability is fixed in 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11."}, {"lang": "es", "value": "Rocket.Chat es una plataforma de comunicaciones de c\u00f3digo abierto, segura y totalmente personalizable. Antes de las versiones 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7 y 7.10.11, el m\u00e9todo DDP sendFileMessage de Rocket.Chat pasa el objeto de archivo completo proporcionado por el atacante a Uploads.updateFileComplete, que lo fusiona directamente en una actualizaci\u00f3n $set de MongoDB a trav\u00e9s de Object.assign. No existe una lista de permitidos de campos escribibles. Un atacante puede, por lo tanto, reescribir cualquier columna en su propio registro de carga, notablemente los campos \u2019store\u2019 y los campos de ruta espec\u00edficos de \u2019store\u2019. Esta vulnerabilidad se corrige en las versiones 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7 y 7.10.11."}], "id": "CVE-2026-45687", "lastModified": "2026-10-25T22:10:00.150", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 4.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-45687", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-26T17:51:10.359261Z", "version": "2.0.3"}}]}, "published": "2026-06-24T21:16:53.720", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-fhc2-x8cp-c5ch"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-915"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.5.0-rc.0,8.5.0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.4.0-rc.0,8.4.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.3.0-rc.0,8.3.3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.2.0-rc.0,8.2.3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.1.0-rc.0,8.1.4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.0.0-rc.0,8.0.5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.11.0-rc.0,7.13.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,7.10.11)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Rocket.Chat", "source": "cna", "vendor": "RocketChat"}, "product": "rocket.chat", "vendor": "rocketchat"}], "created": "2026-06-24T22:45:15.368942+00:00", "updated": "2026-06-25T05:45:02.759956+00:00", "vendors": ["rocketchat", "rocketchat$PRODUCT$rocket.chat"]}