CVE-2026-48929

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-48929", "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "state": "PUBLISHED", "assignerShortName": "hackerone", "dateReserved": "2026-05-26T15:00:06.427Z", "datePublished": "2026-06-16T23:08:37.888Z", "dateUpdated": "2026-06-17T15:02:44.803Z"}, "containers": {"cna": {"descriptions": [{"lang": "en", "value": "Rocket.Chat in versions <8.5.1, <8.4.4, <8.3.6, <8.2.6, <8.1.6, <8.0.7, <7.13.9, and <7.10.13 is vulnerable to unauthenticated file deletion. The deleteFileMessage Meteor method permanently deletes any uploaded file by ID without requiring authentication. When called via an unauthenticated DDP WebSocket connection, Meteor.userId() returns null, causing the authorization check to be skipped. Execution falls through to FileUpload.getStore('Uploads').deleteById(fileID), which removes the file from storage and database unconditionally. File IDs are discoverable from public channel message payloads and download URLs."}], "affected": [{"defaultStatus": "unaffected", "vendor": "Rocket.Chat", "product": "Rocket.Chat", "versions": [{"version": "0", "status": "affected", "lessThan": "8.5.1", "versionType": "semver"}, {"version": "0", "status": "affected", "lessThan": "8.4.4", "versionType": "semver"}, {"version": "0", "status": "affected", "lessThan": "8.3.6", "versionType": "semver"}, {"version": "0", "status": "affected", "lessThan": "8.2.6", "versionType": "semver"}, {"version": "0", "status": "affected", "lessThan": "8.1.6", "versionType": "semver"}, {"version": "0", "status": "affected", "lessThan": "8.0.7", "versionType": "semver"}, {"version": "0", "status": "affected", "lessThan": "7.13.9", "versionType": "semver"}, {"version": "0", "status": "affected", "lessThan": "7.10.13", "versionType": "semver"}]}], "references": [{"url": "https://hackerone.com/reports/3611837"}, {"url": "https://github.com/RocketChat/Rocket.Chat/pull/40889/"}], "metrics": [{"cvssV3_0": {"version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "cweId": "CWE-287", "description": "CWE-287 Improper Authentication - Generic"}]}], "providerMetadata": {"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone", "dateUpdated": "2026-06-16T23:08:37.888Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-17T15:02:38.629156Z", "id": "CVE-2026-48929", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-17T15:02:44.803Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"metrics": [{"cvssV3_0": {"version": "3.0", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}}], "affected": [{"vendor": "Rocket.Chat", "product": "Rocket.Chat", "versions": [{"status": "affected", "version": "0", "lessThan": "8.5.1", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "8.4.4", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "8.3.6", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "8.2.6", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "8.1.6", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "8.0.7", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "7.13.9", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "7.10.13", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://hackerone.com/reports/3611837"}, {"url": "https://github.com/RocketChat/Rocket.Chat/pull/40889/"}], "descriptions": [{"lang": "en", "value": "Rocket.Chat in versions <8.5.1, <8.4.4, <8.3.6, <8.2.6, <8.1.6, <8.0.7, <7.13.9, and <7.10.13 is vulnerable to unauthenticated file deletion. The deleteFileMessage Meteor method permanently deletes any uploaded file by ID without requiring authentication. When called via an unauthenticated DDP WebSocket connection, Meteor.userId() returns null, causing the authorization check to be skipped. Execution falls through to FileUpload.getStore('Uploads').deleteById(fileID), which removes the file from storage and database unconditionally. File IDs are discoverable from public channel message payloads and download URLs."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287 Improper Authentication - Generic"}]}], "providerMetadata": {"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone", "dateUpdated": "2026-06-16T23:08:37.888Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-48929", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-17T15:02:38.629156Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-06-17T15:02:41.240Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-48929", "state": "PUBLISHED", "dateUpdated": "2026-06-16T23:08:37.888Z", "dateReserved": "2026-05-26T15:00:06.427Z", "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "datePublished": "2026-06-16T23:08:37.888Z", "assignerShortName": "hackerone"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Rocket.Chat", "vendor": "Rocket.Chat", "versions": [{"lessThan": "8.5.1", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "8.4.4", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "8.3.6", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "8.2.6", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "8.1.6", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "8.0.7", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "7.13.9", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "7.10.13", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "support@hackerone.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:*", "matchCriteriaId": "848AE1B8-5E16-4848-8C1B-51EF8676EDE5", "versionEndExcluding": "7.10.13", "vulnerable": true}, {"criteria": "cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:*", "matchCriteriaId": "433D60B1-F51D-4F4C-8628-332A27CC7009", "versionEndExcluding": "7.13.9", "versionStartIncluding": "7.13.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:*", "matchCriteriaId": "1D9D3B12-AE81-4FBD-AD25-5F97380FBA5B", "versionEndExcluding": "8.0.7", "versionStartIncluding": "8.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:*", "matchCriteriaId": "0803F4B6-31AA-476F-831C-71DBF8A48F2D", "versionEndExcluding": "8.1.6", "versionStartIncluding": "8.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:*", "matchCriteriaId": "B013E425-EA3E-4802-838D-04DAC0CC8BF2", "versionEndExcluding": "8.2.6", "versionStartIncluding": "8.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:*", "matchCriteriaId": "BF7B1B1C-AE07-4658-901E-0F412B0E3E31", "versionEndExcluding": "8.3.6", "versionStartIncluding": "8.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:*", "matchCriteriaId": "932324CF-CA75-42AE-A449-B9B3726EC187", "versionEndExcluding": "8.4.4", "versionStartIncluding": "8.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:*", "matchCriteriaId": "9DD0F18A-6E6E-4BEF-B72F-ED1A23E9BA66", "versionEndExcluding": "8.5.1", "versionStartIncluding": "8.5.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Rocket.Chat in versions <8.5.1, <8.4.4, <8.3.6, <8.2.6, <8.1.6, <8.0.7, <7.13.9, and <7.10.13 is vulnerable to unauthenticated file deletion. The deleteFileMessage Meteor method permanently deletes any uploaded file by ID without requiring authentication. When called via an unauthenticated DDP WebSocket connection, Meteor.userId() returns null, causing the authorization check to be skipped. Execution falls through to FileUpload.getStore('Uploads').deleteById(fileID), which removes the file from storage and database unconditionally. File IDs are discoverable from public channel message payloads and download URLs."}, {"lang": "es", "value": "Rocket.Chat en versiones anteriores a 8.5.1, anterior a 8.4.4, anterior a 8.3.6, anterior a 8.2.6, anterior a 8.1.6, anterior a 8.0.7, anterior a 7.13.9 y anterior a 7.10.13 es vulnerable a la eliminaci\u00f3n de archivos no autenticada. El m\u00e9todo Meteor deleteFileMessage elimina permanentemente cualquier archivo subido por ID sin requerir autenticaci\u00f3n. Cuando se llama a trav\u00e9s de una conexi\u00f3n DDP WebSocket no autenticada, Meteor.userId() devuelve null, causando que la verificaci\u00f3n de autorizaci\u00f3n sea omitida. La ejecuci\u00f3n pasa a FileUpload.getStore('Uploads').deleteById(fileID), que elimina el archivo del almacenamiento y la base de datos incondicionalmente. Los ID de archivo son descubribles a partir de las cargas \u00fatiles de mensajes de canales p\u00fablicos y las URL de descarga."}], "id": "CVE-2026-48929", "lastModified": "2026-10-24T13:10:00.147", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "support@hackerone.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48929", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-17T15:02:38.629156Z", "version": "2.0.3"}}]}, "published": "2026-06-17T13:20:44.550", "references": [{"source": "support@hackerone.com", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://github.com/RocketChat/Rocket.Chat/pull/40889/"}, {"source": "support@hackerone.com", "tags": ["Third Party Advisory"], "url": "https://hackerone.com/reports/3611837"}], "sourceIdentifier": "support@hackerone.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "support@hackerone.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,8.5.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,8.4.4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,8.3.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,8.2.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,8.1.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,8.0.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,7.13.9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,7.10.13)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Rocket.Chat", "source": "cna", "vendor": "Rocket.Chat"}, "product": "rocket.chat", "vendor": "rocket.chat"}], "created": "2026-06-17T01:30:04.921525+00:00", "title": "Unauthenticated File Deletion in Rocket.Chat via deleteFileMessage", "updated": "2026-06-17T18:45:10.828260+00:00", "vendors": ["rocket.chat", "rocket.chat$PRODUCT$rocket.chat"]}