Description

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1, the stream-notify-user stream in the WebSocket protocol allows an authenticated user to write arbitrary notification bodies because the sender is not checked, and the client-side UI can create an ephemeral fake message in another user's currently open chat. This issue is fixed in versions 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-10T22:17:10.807Z",
  "pubdate": "2026-08-10T22:17:10.807Z",
  "executiveSummary": "An improper authorization and input validation vulnerability exists within the WebSocket protocol implementation of Rocket.Chat. The flaw resides specifically in the stream-notify-user stream, where the application fails to adequately validate or verify the sender of the notification body. Consequently, an authenticated malicious user can exploit this lack of sender verification to write arbitrary notification bodies across the communication platform. The primary impact of this vulnerability involves UI-level deception, allowing an attacker to inject and render ephemeral fake messages directly within another user's currently open chat interface. This capability compromises the integrity of user communications, facilitates social engineering, and undermines trust in the platform's messaging integrity. The vulnerability affects multiple product branches prior to versions 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1. Successful exploitation requires network access to the WebSocket interface and valid user authentication to establish a connection, but it does not demand elevated administrative privileges. Risk implications are moderate to high depending on organizational reliance on uncompromised chat logs and real-time operational communications.",
  "technicalDetails": "The root cause of the vulnerability stems from missing authorization checks and sender validation logic within the WebSocket protocol handler managing the stream-notify-user stream in Rocket.Chat. In a secure publish-subscribe messaging architecture, server-side handlers must authenticate that the entity initiating a broadcast or targeted stream notification possesses the appropriate privileges and identity to do so. In this vulnerable implementation, the backend accepts notification payloads over the WebSocket channel without verifying whether the authenticated user submitting the payload is authorized to send messages on behalf of that specific stream or target user context.\nThe vulnerable component is the WebSocket streaming subsystem, specifically handling real-time event distribution via the stream-notify-user stream. Affected software versions include all deployments of Rocket.Chat prior to 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1.\nThe attack flow proceeds as follows: First, an attacker establishes an authenticated session with the Rocket.Chat server and connects to the WebSocket interface. Second, instead of utilizing standard authorized message routing mechanisms, the attacker crafts a malicious WebSocket frame targeting the stream-notify-user stream. Third, within this payload, the attacker populates an arbitrary notification body containing fabricated message content designed to impersonate another user or system entity. Fourth, because the server processes the stream-notify-user message without validating the sender's authority or ownership of the transmission context, it broadcasts the payload to the intended recipient's client session. Finally, upon receiving the malicious stream notification, the victim's client-side UI parses the payload and renders an ephemeral fake message directly inside their currently active chat window, deceiving the victim into believing a legitimate message or system alert was received from a trusted source."
}