RocketChat has 4 CVEs on record. 1 was published in the last 90 days. The busiest recent month was June 2026 with 3. The median CVSS is 7.9 (high), with 2 rated critical.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.9
- Publish → KEV
- —
- Last 90 days
- 1 prev 3
Worst active — by depth score
CVE-2026-45689Critical· 9.1Rocket.Chat is an open-source, secure, fully customizable communications platform62CVE-2026-45688Critical· 9.1Rocket.Chat is an open-source, secure, fully customizable communications platform62CVE-2026-49278Medium· 6.7Rocket.Chat is an open-source, secure, fully customizable communications platform37CVE-2026-75575Medium· 5.3Rocket.Chat exposes the sendForgotPasswordEmail Meteor method without a DDP rate limit, so an unauthenticated caller may invoke it as often as it likes29
RocketChat vulnerabilities
CVEs affecting RocketChat, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
CVE-2026-75575Medium· 5.3Rocket.Chat exposes the sendForgotPasswordEmail Meteor method without a DDP rate limit, so an unauthenticated caller may invoke it as often as it likes
Rocket.Chat exposes the sendForgotPasswordEmail Meteor method without a DDP rate limit, so an unauthenticated caller may invoke it as often as it likes. The method is reachable over DDP and over the HTTP route POST /api/v1/method.callAno…
CVE-2026-49278Medium· 6.7Rocket.Chat is an open-source, secure, fully customizable communications platform
Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12, in the visitors.info endpoint, https://developer.rocket.chat/apidocs/get-visitor-i…
CVE-2026-45689Critical· 9.1PoCRocket.Chat is an open-source, secure, fully customizable communications platform
Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11, an unauthenticated network attacker obtains a valid Rocket.Chat OAuth access token…
CVE-2026-45688Critical· 9.1PoCRocket.Chat is an open-source, secure, fully customizable communications platform
Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11, Rocket.Chat's CAS login handler forwards the client-supplied options.cas.credentia…