CVE-2026-45689

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-45689", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-13T04:38:01.164Z", "datePublished": "2026-06-24T20:57:32.281Z", "dateUpdated": "2026-11-03T22:13:25.239Z"}, "containers": {"cna": {"title": "Rocket.Chat: Pre-Auth NoSQL Injection in OAuth2 Token Endpoint leading to Arbitrary User ATO", "problemTypes": [{"descriptions": [{"cweId": "CWE-943", "lang": "en", "description": "CWE-943: Improper Neutralization of Special Elements in Data Query Logic", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-8p25-fm45-pjrw", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-8p25-fm45-pjrw"}], "affected": [{"vendor": "RocketChat", "product": "Rocket.Chat", "versions": [{"version": ">= 8.5.0-rc.0, < 8.5.0", "status": "affected"}, {"version": ">= 8.4.0-rc.0, < 8.4.1", "status": "affected"}, {"version": ">= 8.3.0-rc.0, < 8.3.3", "status": "affected"}, {"version": ">= 8.2.0-rc.0, < 8.2.3", "status": "affected"}, {"version": ">= 8.1.0-rc.0, < 8.1.4", "status": "affected"}, {"version": ">= 8.0.0-rc.0, < 8.0.5", "status": "affected"}, {"version": ">= 7.11.0-rc.0, < 7.13.7", "status": "affected"}, {"version": "< 7.10.11", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-24T20:57:32.281Z"}, "descriptions": [{"lang": "en", "value": "Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11, an unauthenticated network attacker obtains a valid Rocket.Chat OAuth access token for an arbitrary user by sending a single HTTP POST with MongoDB query operators to /oauth/token. The Rocket.Chat OAuth2 server does not validate that grant parameters are strings before forwarding them to findOne({...}) against the oauth_apps and oauth_access_tokens collections, so an attacker substitutes {\"$ne\": null} for client_id, client_secret, and refresh_token and receives a freshly minted {access_token, refresh_token} pair bound to whichever user's refresh token Mongo returned first. The resulting access token is a first-class bearer credential against the full /api/v1/* surface as that user. By iterating with $nin / $regex operators the attacker walks the entire oauth_access_tokens collection, collecting one fresh access token per user per request. If any matched token belongs to an admin, the stolen bearer gives full admin API access (including Apps-Engine app installation, i.e. server-side code execution). No account, credentials, userId, or prior interaction with the instance are required. This vulnerability is fixed in 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11."}], "source": {"advisory": "GHSA-8p25-fm45-pjrw", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-45689", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-06-26T03:55:35.841877Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-03T22:13:25.239Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-45689", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-06-26T03:55:35.841877Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-25T12:35:19.180Z"}}], "cna": {"title": "Rocket.Chat: Pre-Auth NoSQL Injection in OAuth2 Token Endpoint leading to Arbitrary User ATO", "source": {"advisory": "GHSA-8p25-fm45-pjrw", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "RocketChat", "product": "Rocket.Chat", "versions": [{"status": "affected", "version": ">= 8.5.0-rc.0, < 8.5.0"}, {"status": "affected", "version": ">= 8.4.0-rc.0, < 8.4.1"}, {"status": "affected", "version": ">= 8.3.0-rc.0, < 8.3.3"}, {"status": "affected", "version": ">= 8.2.0-rc.0, < 8.2.3"}, {"status": "affected", "version": ">= 8.1.0-rc.0, < 8.1.4"}, {"status": "affected", "version": ">= 8.0.0-rc.0, < 8.0.5"}, {"status": "affected", "version": ">= 7.11.0-rc.0, < 7.13.7"}, {"status": "affected", "version": "< 7.10.11"}]}], "references": [{"url": "https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-8p25-fm45-pjrw", "name": "https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-8p25-fm45-pjrw", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11, an unauthenticated network attacker obtains a valid Rocket.Chat OAuth access token for an arbitrary user by sending a single HTTP POST with MongoDB query operators to /oauth/token. The Rocket.Chat OAuth2 server does not validate that grant parameters are strings before forwarding them to findOne({...}) against the oauth_apps and oauth_access_tokens collections, so an attacker substitutes {\"$ne\": null} for client_id, client_secret, and refresh_token and receives a freshly minted {access_token, refresh_token} pair bound to whichever user's refresh token Mongo returned first. The resulting access token is a first-class bearer credential against the full /api/v1/* surface as that user. By iterating with $nin / $regex operators the attacker walks the entire oauth_access_tokens collection, collecting one fresh access token per user per request. If any matched token belongs to an admin, the stolen bearer gives full admin API access (including Apps-Engine app installation, i.e. server-side code execution). No account, credentials, userId, or prior interaction with the instance are required. This vulnerability is fixed in 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-943", "description": "CWE-943: Improper Neutralization of Special Elements in Data Query Logic"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-24T20:57:32.281Z"}}}, "cveMetadata": {"cveId": "CVE-2026-45689", "state": "PUBLISHED", "dateUpdated": "2026-11-03T22:13:25.239Z", "dateReserved": "2026-05-13T04:38:01.164Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-24T20:57:32.281Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Rocket.Chat", "vendor": "RocketChat", "versions": [{"status": "affected", "version": ">= 8.5.0-rc.0, < 8.5.0"}, {"status": "affected", "version": ">= 8.4.0-rc.0, < 8.4.1"}, {"status": "affected", "version": ">= 8.3.0-rc.0, < 8.3.3"}, {"status": "affected", "version": ">= 8.2.0-rc.0, < 8.2.3"}, {"status": "affected", "version": ">= 8.1.0-rc.0, < 8.1.4"}, {"status": "affected", "version": ">= 8.0.0-rc.0, < 8.0.5"}, {"status": "affected", "version": ">= 7.11.0-rc.0, < 7.13.7"}, {"status": "affected", "version": "< 7.10.11"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11, an unauthenticated network attacker obtains a valid Rocket.Chat OAuth access token for an arbitrary user by sending a single HTTP POST with MongoDB query operators to /oauth/token. The Rocket.Chat OAuth2 server does not validate that grant parameters are strings before forwarding them to findOne({...}) against the oauth_apps and oauth_access_tokens collections, so an attacker substitutes {\"$ne\": null} for client_id, client_secret, and refresh_token and receives a freshly minted {access_token, refresh_token} pair bound to whichever user's refresh token Mongo returned first. The resulting access token is a first-class bearer credential against the full /api/v1/* surface as that user. By iterating with $nin / $regex operators the attacker walks the entire oauth_access_tokens collection, collecting one fresh access token per user per request. If any matched token belongs to an admin, the stolen bearer gives full admin API access (including Apps-Engine app installation, i.e. server-side code execution). No account, credentials, userId, or prior interaction with the instance are required. This vulnerability is fixed in 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11."}, {"lang": "es", "value": "Rocket.Chat es una plataforma de comunicaciones de c\u00f3digo abierto, segura y totalmente personalizable. Antes de 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7 y 7.10.11, un atacante de red no autenticado obtiene un token de acceso OAuth v\u00e1lido de Rocket.Chat para un usuario arbitrario enviando un \u00fanico HTTP POST con operadores de consulta de MongoDB a /oauth/token. El servidor OAuth2 de Rocket.Chat no valida que los par\u00e1metros de concesi\u00f3n sean cadenas antes de reenviarlos a findOne({...}) contra las colecciones oauth_apps y oauth_access_tokens, por lo que un atacante sustituye {\u2019$ne\u2019: null} por client_id, client_secret y refresh_token y recibe un par {access_token, refresh_token} reci\u00e9n emitido vinculado al token de actualizaci\u00f3n de cualquier usuario que Mongo devolvi\u00f3 primero. El token de acceso resultante es una credencial de portador de primera clase contra la superficie completa de /api/v1/* como ese usuario. Al iterar con los operadores $nin / $regex, el atacante recorre toda la colecci\u00f3n oauth_access_tokens, recolectando un token de acceso nuevo por usuario por solicitud. Si alg\u00fan token coincidente pertenece a un administrador, el portador robado otorga acceso completo a la API de administrador (incluyendo la instalaci\u00f3n de aplicaciones de Apps-Engine, es decir, ejecuci\u00f3n de c\u00f3digo del lado del servidor). No se requiere ninguna cuenta, credenciales, userId o interacci\u00f3n previa con la instancia. Esta vulnerabilidad se corrige en 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7 y 7.10.11."}], "id": "CVE-2026-45689", "lastModified": "2026-11-03T23:17:44.823", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-45689", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-06-26T03:55:35.841877Z", "version": "2.0.3"}}]}, "published": "2026-06-24T21:16:53.970", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-8p25-fm45-pjrw"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-943"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.5.0-rc.0,8.5.0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.4.0-rc.0,8.4.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.3.0-rc.0,8.3.3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.2.0-rc.0,8.2.3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.1.0-rc.0,8.1.4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.0.0-rc.0,8.0.5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.11.0-rc.0,7.13.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,7.10.11)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Rocket.Chat", "source": "cna", "vendor": "RocketChat"}, "product": "rocket.chat", "vendor": "rocketchat"}], "created": "2026-06-24T23:15:03.149259+00:00", "updated": "2026-06-25T05:30:04.922844+00:00", "vendors": ["rocketchat", "rocketchat$PRODUCT$rocket.chat"]}