CVE-2026-29197: Rocket.Chat Auth Bypass Vulnerability

CVE-2026-29197 Overview

CVE-2026-29197 is an authorization bypass vulnerability in Rocket.Chat that allows authenticated users to access apps-engine logs without the proper permissions. The vulnerability exists in the /api/apps/logs and /api/apps/:id/logs endpoints, where a typo in the permission check allows users who lack the required authorization to read sensitive application logs.

This vulnerability affects multiple versions of Rocket.Chat across several release branches, potentially exposing internal application logging data to unauthorized users within the platform.

Critical Impact

Authenticated users without proper permissions can read apps-engine logs, potentially exposing sensitive application data, debug information, and internal system details that could aid further attacks.

Affected Products

• Rocket.Chat versions prior to 8.4.0
• Rocket.Chat versions prior to 8.3.2
• Rocket.Chat versions prior to 8.2.2
• Rocket.Chat versions prior to 8.1.3
• Rocket.Chat versions prior to 8.0.4
• Rocket.Chat versions prior to 7.13.6
• Rocket.Chat versions prior to 7.12.7
• Rocket.Chat versions prior to 7.11.7
• Rocket.Chat versions prior to 7.10.10

Discovery Timeline

• 2026-04-24 - CVE-2026-29197 published to NVD
• 2026-04-28 - Last updated in NVD database

Technical Details for CVE-2026-29197

Vulnerability Analysis

This vulnerability falls under CWE-284 (Improper Access Control) and represents a broken access control flaw in Rocket.Chat's API layer. The root issue is a typo in the permission validation logic for two API endpoints that handle apps-engine log retrieval.

The affected endpoints /api/apps/logs and /api/apps/:id/logs are designed to be restricted to administrators or users with specific log-viewing permissions. However, due to a coding error in the permission check implementation, the authorization validation does not function as intended. This allows any authenticated user to query these endpoints and retrieve application logs that should be restricted.

The vulnerability requires network access and an authenticated session but does not require any additional privileges beyond basic authentication, making it exploitable by any user with a valid Rocket.Chat account.

Root Cause

The vulnerability stems from a typo in the required permission check within the API endpoint handlers. The incorrect permission string means the authorization middleware fails to properly validate whether the requesting user has the necessary privileges to access apps-engine logs. This is a classic broken access control issue where the implementation does not match the intended security design.

Attack Vector

An attacker with a valid Rocket.Chat user account can exploit this vulnerability by making direct API requests to the affected endpoints. The attack flow involves:

1. Authenticating to the Rocket.Chat instance with any valid user credentials
2. Sending HTTP GET requests to /api/apps/logs or /api/apps/:id/logs endpoints
3. Receiving log data that should be restricted to privileged users only

The vulnerability is exploitable over the network without user interaction. An attacker can craft API requests directly or use the Rocket.Chat web interface if it exposes these endpoints through the UI.

The logs accessed through this vulnerability may contain sensitive information such as application errors, debug data, integration details, webhook information, and potentially credentials or tokens used by apps-engine integrations. For detailed technical information, see the HackerOne Security Report.

Detection Methods for CVE-2026-29197

Indicators of Compromise

• Unusual API activity from non-administrative users targeting /api/apps/logs or /api/apps/:id/logs endpoints
• Unexpected successful responses (HTTP 200) to log endpoints from users without administrative privileges
• Access logs showing repeated queries to apps-engine log endpoints by regular user accounts

Detection Strategies

• Monitor API access logs for requests to /api/apps/logs and /api/apps/:id/logs endpoints
• Implement anomaly detection for users accessing endpoints outside their normal behavior patterns
• Review authentication logs to identify users who accessed log endpoints without proper role assignments
• Deploy web application firewall rules to flag suspicious patterns of log endpoint access

Monitoring Recommendations

• Enable detailed access logging for all Rocket.Chat API endpoints
• Configure alerting for any access to sensitive administrative endpoints by non-privileged users
• Implement real-time monitoring of API response codes to detect unauthorized successful access attempts
• Regularly audit user permissions to ensure proper access control configuration

How to Mitigate CVE-2026-29197

Immediate Actions Required

• Upgrade Rocket.Chat to the latest patched version in your release branch (8.4.0, 8.3.2, 8.2.2, 8.1.3, 8.0.4, 7.13.6, 7.12.7, 7.11.7, or 7.10.10)
• Review access logs for any unauthorized access to the affected endpoints prior to patching
• Audit the contents of apps-engine logs for any sensitive information that may have been exposed
• Consider rotating any credentials or tokens that may have been logged in apps-engine logs

Patch Information

Rocket.Chat has released security patches across multiple version branches to address this vulnerability. The fix corrects the typo in the permission check logic, ensuring that only users with the proper authorization can access apps-engine logs. The patch is available via the GitHub Pull Request #40125.

Organizations should upgrade to one of the following patched versions based on their current deployment:

• Version 8.x: Upgrade to 8.4.0, 8.3.2, 8.2.2, 8.1.3, or 8.0.4
• Version 7.x: Upgrade to 7.13.6, 7.12.7, 7.11.7, or 7.10.10

Workarounds

• Implement network-level access controls to restrict API access to trusted networks or IP addresses
• Deploy a reverse proxy or WAF with rules to block unauthorized requests to /api/apps/logs and /api/apps/:id/logs endpoints
• Limit user registrations and conduct periodic reviews of user accounts to minimize the pool of potential attackers
• Monitor and alert on any access to the affected endpoints until patching is complete

# Example: Nginx reverse proxy rule to restrict access to affected endpoints
location ~ ^/api/apps(/[^/]+)?/logs {
    # Only allow access from trusted admin IPs until patched
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://rocketchat_backend;
}