CVE-2026-23477: Rocket.Chat Information Disclosure Flaw

CVE-2026-23477 Overview

CVE-2026-23477 is an information disclosure vulnerability affecting Rocket.Chat, an open-source, secure, fully customizable communications platform. In versions prior to 6.12.0, the API endpoint GET /api/v1/oauth-apps.get is exposed to any authenticated user, regardless of their role or permissions. This endpoint returns OAuth application data when a user knows the application ID, including potentially sensitive fields such as client_id and client_secret. This represents a significant broken access control flaw that could lead to unauthorized access to integrated systems.

Critical Impact

Authenticated users can access sensitive OAuth application credentials including client secrets, potentially enabling unauthorized access to connected third-party services and OAuth-protected resources.

Affected Products

• Rocket.Chat versions prior to 6.12.0
• Self-hosted Rocket.Chat deployments with OAuth integrations
• Rocket.Chat instances with custom OAuth applications configured

Discovery Timeline

• January 14, 2026 - CVE-2026-23477 published to NVD
• January 16, 2026 - Last updated in NVD database

Technical Details for CVE-2026-23477

Vulnerability Analysis

This vulnerability is classified under CWE-269 (Improper Privilege Management), indicating a fundamental flaw in how Rocket.Chat handles authorization for the OAuth applications API endpoint. The core issue stems from the application failing to verify whether an authenticated user has the appropriate permissions to access OAuth application details before returning sensitive data.

The /api/v1/oauth-apps.get endpoint should be restricted to administrators or users with explicit OAuth management privileges. Instead, the endpoint grants access to any authenticated user who can provide a valid OAuth application ID. This design flaw exposes client_id and client_secret values that are critical security components of the OAuth 2.0 flow.

Exposure of these credentials could allow attackers to impersonate the legitimate application when authenticating against OAuth providers, intercept authorization codes, or gain unauthorized access to user data and resources protected by the compromised OAuth integration.

Root Cause

The root cause of this vulnerability is insufficient authorization validation on the /api/v1/oauth-apps.get API endpoint. The endpoint only verifies that a user is authenticated but does not check whether the authenticated user has administrative privileges or specific permissions to view OAuth application configurations.

This represents a classic broken access control vulnerability where the application relies solely on authentication status rather than implementing proper role-based access control (RBAC) for sensitive administrative functions.

Attack Vector

The attack vector for this vulnerability is network-based and requires a low-privilege authenticated user. An attacker who has obtained valid credentials to a Rocket.Chat instance (even as a regular user) can exploit this vulnerability by:

1. Enumerating or guessing OAuth application IDs
2. Making authenticated API requests to /api/v1/oauth-apps.get with target application IDs
3. Extracting the returned client_id and client_secret values
4. Using the stolen credentials to impersonate the legitimate OAuth application

The vulnerability requires network access to the Rocket.Chat API and any valid authenticated session. The attack does not require user interaction beyond the attacker authenticating to the platform.

Detection Methods for CVE-2026-23477

Indicators of Compromise

• Unusual API requests to /api/v1/oauth-apps.get from non-administrative user accounts
• Multiple requests to the OAuth apps endpoint with sequential or enumerated application IDs
• Access logs showing OAuth endpoint queries from users who should not require OAuth management capabilities
• Suspicious OAuth token generation activity from previously dormant or newly compromised OAuth applications

Detection Strategies

• Monitor API access logs for calls to /api/v1/oauth-apps.get and correlate with user roles to identify unauthorized access attempts
• Implement alerting for any non-administrator user accessing OAuth-related API endpoints
• Review authentication logs for OAuth applications to identify unexpected credential usage patterns
• Deploy API gateway rules to log and alert on sensitive endpoint access patterns

Monitoring Recommendations

• Enable detailed API logging for all OAuth-related endpoints in Rocket.Chat
• Configure SIEM rules to detect enumeration patterns against OAuth application endpoints
• Establish baseline behavior for OAuth API access and alert on deviations
• Monitor for OAuth token generation from applications that recently had their endpoints queried

How to Mitigate CVE-2026-23477

Immediate Actions Required

• Upgrade Rocket.Chat to version 6.12.0 or later immediately
• Rotate all OAuth application client_secret values for any applications configured in affected Rocket.Chat instances
• Review API access logs to determine if the vulnerability may have been exploited
• Audit connected OAuth provider logs for suspicious authorization activity

Patch Information

Rocket.Chat has addressed this vulnerability in version 6.12.0. The fix implements proper authorization checks on the /api/v1/oauth-apps.get endpoint to ensure only users with appropriate administrative permissions can access OAuth application details including sensitive credentials.

Organizations should upgrade to version 6.12.0 or the latest available version as soon as possible. For detailed information about the security fix, refer to the GitHub Security Advisory.

Workarounds

• Implement network-level access controls to restrict API access to trusted IP ranges or VPN users only
• Use a reverse proxy or API gateway to block unauthenticated access to /api/v1/oauth-apps.get endpoint until patching is complete
• Temporarily disable OAuth integrations if they are not critical to operations
• Implement additional authentication requirements (MFA) for all users to reduce risk of credential compromise

# Example: Block access to vulnerable endpoint using nginx
# Add to your nginx configuration for Rocket.Chat
location /api/v1/oauth-apps.get {
    # Only allow access from admin IP ranges
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://rocketchat_backend;
}