CVE-2026-45687: Rocket.Chat SQLi Vulnerability

CVE-2026-45687 Overview

CVE-2026-45687 is a mass assignment vulnerability in Rocket.Chat, an open-source communications platform. The sendFileMessage Distributed Data Protocol (DDP) method passes the entire attacker-supplied file object into Uploads.updateFileComplete, which merges it directly into a MongoDB $set update via Object.assign. No allow-list controls which fields can be written. An authenticated attacker can rewrite arbitrary columns on their own upload record, including the store field and store-specific path fields. The flaw is tracked under [CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes].

Critical Impact
Authenticated attackers can manipulate file upload metadata to redirect storage paths and tamper with file records, enabling tenant isolation bypass and integrity violations across Rocket.Chat deployments.

Affected Products

Rocket.Chat versions prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, and 8.0.5
Rocket.Chat versions prior to 7.13.7
Rocket.Chat versions prior to 7.10.11

Discovery Timeline

2026-06-24 - CVE-2026-45687 published to the National Vulnerability Database (NVD)
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-45687

Vulnerability Analysis

The vulnerability resides in Rocket.Chat's file upload completion workflow. When a client invokes the sendFileMessage DDP method, the server accepts a file object describing the uploaded asset. The handler forwards the full client-supplied object into Uploads.updateFileComplete without validating which properties belong on the upload document.

Inside Uploads.updateFileComplete, the object is combined with internal state through Object.assign and then written to MongoDB using a $set operator. Because no allow-list constrains writable fields, every attribute provided by the attacker becomes part of the update. This pattern is a classic mass assignment defect catalogued as [CWE-915].

The most security-relevant fields an attacker can overwrite are store, which selects the storage backend, and the store-specific path field, which dictates where the file physically resides. Rewriting these allows tampering with the metadata that downstream code uses to locate, serve, or attribute the upload.

Root Cause

The root cause is missing input filtering between the DDP client boundary and the database update layer. The application trusts the structure of the client-supplied file object instead of enumerating the fields it is willing to persist. Combined with Object.assign semantics, this trust collapses into a direct write primitive against the user's own upload record.

Attack Vector

Exploitation requires a low-privileged authenticated session. The attacker calls sendFileMessage with additional properties on the file object such as store or path. The server merges those properties into the database update for the attacker's own upload, modifying the record to attacker-controlled values without any further authorization check. The attack is network-reachable and does not require user interaction.

No verified public proof-of-concept code is available. Technical specifics are documented in the Rocket.Chat GitHub Security Advisory GHSA-fhc2-x8cp-c5ch.

Detection Methods for CVE-2026-45687

Indicators of Compromise

Upload records in the rocketchat_uploads collection containing unexpected values in the store or path fields that do not match the deployment's configured storage backend.
DDP method calls to sendFileMessage carrying file objects with extraneous keys beyond the documented schema.
Files referenced in messages whose stored paths point outside the configured upload root or to other tenants' storage namespaces.

Detection Strategies

Audit MongoDB upload documents for anomalies in storage-related fields, comparing values against the server's configured FileUpload_Storage_Type.
Enable verbose logging on DDP method invocations and inspect payloads for sendFileMessage requests with non-standard properties.
Correlate file access errors and missing-asset events with recent upload events from the same user identifier.

Monitoring Recommendations

Track post-upload modifications to upload records and alert on writes that change store, path, or other backend-controlled fields after initial creation.
Monitor authentication logs for accounts performing high-volume file upload activity followed by metadata mutations.
Forward Rocket.Chat application logs to a centralized analytics platform for retroactive hunting once patches are applied.

How to Mitigate CVE-2026-45687

Immediate Actions Required

Upgrade Rocket.Chat to a fixed release matching your current branch: 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, or 7.10.11.
Inventory existing upload records and review any whose store or path fields deviate from expected defaults before restoring trust in stored files.
Rotate credentials and review account activity for users who recently invoked file upload functionality if tampering is suspected.

Patch Information

Rocket.Chat resolved the issue by adding an explicit allow-list of writable fields inside Uploads.updateFileComplete, preventing attacker-controlled properties from reaching the MongoDB $set update. Patched versions are 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11. Full remediation details are published in the Rocket.Chat GitHub Security Advisory GHSA-fhc2-x8cp-c5ch.

Workarounds

Restrict access to Rocket.Chat instances that cannot be immediately patched by placing them behind authenticated reverse proxies and limiting account creation.
Disable file uploads using the FileUpload_Enabled administrative setting until the upgrade is applied if the feature is non-essential.
Apply MongoDB-side schema validation on the uploads collection to reject documents containing unexpected storage backend identifiers.

bash

# Configuration example: disable file uploads via Rocket.Chat admin API
curl -H "X-Auth-Token: $AUTH_TOKEN" \
     -H "X-User-Id: $USER_ID" \
     -H "Content-Type: application/json" \
     -X POST "$ROCKETCHAT_URL/api/v1/settings/FileUpload_Enabled" \
     -d '{"value": false}'