CVE-2026-72918

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-72918", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-08-10T17:57:26.144Z", "datePublished": "2026-08-10T21:42:36.707Z", "dateUpdated": "2026-08-11T16:04:45.242Z"}, "containers": {"cna": {"title": "Rocket.Chat: Insecure implementation of websocket notifications", "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "lang": "en", "description": "CWE-862: Missing Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-27jx-236m-3f5j", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-27jx-236m-3f5j"}], "affected": [{"vendor": "RocketChat", "product": "Rocket.Chat", "versions": [{"version": "< 7.10.14", "status": "affected"}, {"version": ">= 8.0.0, < 8.0.8", "status": "affected"}, {"version": ">= 8.1.0, < 8.1.7", "status": "affected"}, {"version": ">= 8.2.0, < 8.2.7", "status": "affected"}, {"version": ">= 8.3.0, < 8.3.7", "status": "affected"}, {"version": ">= 8.4.0, < 8.4.5", "status": "affected"}, {"version": ">= 8.5.0, < 8.5.2", "status": "affected"}, {"version": ">= 8.6.0, < 8.6.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-10T21:42:36.707Z"}, "descriptions": [{"lang": "en", "value": "Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1, the stream-notify-user stream in the WebSocket protocol allows an authenticated user to write arbitrary notification bodies because the sender is not checked, and the client-side UI can create an ephemeral fake message in another user's currently open chat. This issue is fixed in versions 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1."}], "source": {"advisory": "GHSA-27jx-236m-3f5j", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-11T16:04:20.390453Z", "id": "CVE-2026-72918", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-11T16:04:45.242Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-72918", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-11T16:04:20.390453Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-11T16:04:38.406Z"}}], "cna": {"title": "Rocket.Chat: Insecure implementation of websocket notifications", "source": {"advisory": "GHSA-27jx-236m-3f5j", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "RocketChat", "product": "Rocket.Chat", "versions": [{"status": "affected", "version": "< 7.10.14"}, {"status": "affected", "version": ">= 8.0.0, < 8.0.8"}, {"status": "affected", "version": ">= 8.1.0, < 8.1.7"}, {"status": "affected", "version": ">= 8.2.0, < 8.2.7"}, {"status": "affected", "version": ">= 8.3.0, < 8.3.7"}, {"status": "affected", "version": ">= 8.4.0, < 8.4.5"}, {"status": "affected", "version": ">= 8.5.0, < 8.5.2"}, {"status": "affected", "version": ">= 8.6.0, < 8.6.1"}]}], "references": [{"url": "https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-27jx-236m-3f5j", "name": "https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-27jx-236m-3f5j", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1, the stream-notify-user stream in the WebSocket protocol allows an authenticated user to write arbitrary notification bodies because the sender is not checked, and the client-side UI can create an ephemeral fake message in another user's currently open chat. This issue is fixed in versions 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-10T21:42:36.707Z"}}}, "cveMetadata": {"cveId": "CVE-2026-72918", "state": "PUBLISHED", "dateUpdated": "2026-08-11T16:04:45.242Z", "dateReserved": "2026-08-10T17:57:26.144Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-10T21:42:36.707Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Rocket.Chat", "vendor": "RocketChat", "versions": [{"status": "affected", "version": "< 7.10.14"}, {"status": "affected", "version": ">= 8.0.0, < 8.0.8"}, {"status": "affected", "version": ">= 8.1.0, < 8.1.7"}, {"status": "affected", "version": ">= 8.2.0, < 8.2.7"}, {"status": "affected", "version": ">= 8.3.0, < 8.3.7"}, {"status": "affected", "version": ">= 8.4.0, < 8.4.5"}, {"status": "affected", "version": ">= 8.5.0, < 8.5.2"}, {"status": "affected", "version": ">= 8.6.0, < 8.6.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1, the stream-notify-user stream in the WebSocket protocol allows an authenticated user to write arbitrary notification bodies because the sender is not checked, and the client-side UI can create an ephemeral fake message in another user's currently open chat. This issue is fixed in versions 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1."}, {"lang": "es", "value": "Rocket.Chat es una plataforma de comunicaciones de c\u00f3digo abierto, segura y totalmente personalizable. Antes de las versiones 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2 y 8.6.1, la transmisi\u00f3n stream-notify-user en el protocolo WebSocket permite a un usuario autenticado escribir cuerpos de notificaci\u00f3n arbitrarios porque el remitente no es verificado, y la interfaz de usuario del lado del cliente puede crear un mensaje falso ef\u00edmero en el chat actualmente abierto de otro usuario. Este problema est\u00e1 solucionado en las versiones 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2 y 8.6.1."}], "id": "CVE-2026-72918", "lastModified": "2026-10-24T15:10:00.190", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-72918", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-11T16:04:20.390453Z", "version": "2.0.3"}}]}, "published": "2026-08-10T22:17:10.807", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-27jx-236m-3f5j"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,7.10.14)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.0.0,8.0.8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.1.0,8.1.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.2.0,8.2.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.3.0,8.3.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.4.0,8.4.5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.5.0,8.5.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.6.0,8.6.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Rocket.Chat", "source": "cna", "vendor": "RocketChat"}, "product": "rocket.chat", "vendor": "rocketchat"}], "created": "2026-08-11T00:15:04.412734+00:00", "updated": "2026-08-11T02:00:06.256110+00:00", "vendors": ["rocketchat", "rocketchat$PRODUCT$rocket.chat"]}