CVE-2026-49278Medium· 6.7▾ SunlitRocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12, in the visitors.info endpoint, https://developer.rocket.chat/apidocs/get-visitor-i…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 36.9 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.4%
Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12, in the visitors.info endpoint, https://developer.rocket.chat/apidocs/get-visitor-information-by-id-1, token is returned in the response. It looks like there's no use case for the token to be present in the response and it would be a good security practice to remove it altogether. This vulnerability is fixed in 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-45688Critical· 9.1Rocket.Chat is an open-source, secure, fully customizable communications platform
CVE-2026-45689Critical· 9.1Rocket.Chat is an open-source, secure, fully customizable communications platform
CVE-2026-75575Medium· 5.3Rocket.Chat exposes the sendForgotPasswordEmail Meteor method without a DDP rate limit, so an unauthenticated caller may invoke it as often as it likes
CVE-2026-123023High· 7.3agentscope-ai AgentScope Bash Tool _bash.py check_permissions authorization
CVE-2026-120319Medium· 6.3Sanluan PublicCMS publiccms-trade TradeRefundService.java TradeRefundService.updateAmound authorization
CVE-2024-6840Medium· 6.6Automation-controller: gain access to the k8s api server via job execution with container group