CVE-2026-45757 Overview
CVE-2026-45757 is an insufficient session expiration vulnerability [CWE-613] in Rocket.Chat, an open-source communications platform. The flaw allows users deactivated through the users.deactivateIdle administrative action to continue using login tokens issued before deactivation. A user marked inactive for idleness retains access to authenticated REST endpoints with the previously issued token. The vulnerability affects Rocket.Chat versions prior to 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12. The maintainers released fixes across all supported branches.
Critical Impact
Deactivated idle users can continue accessing authenticated REST API endpoints using previously issued login tokens, bypassing the intended access revocation.
Affected Products
- Rocket.Chat versions prior to 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12
- Rocket.Chat deployments using the users.deactivateIdle administrative function
- Self-hosted and cloud Rocket.Chat instances on affected versions
Discovery Timeline
- 2026-06-24 - CVE-2026-45757 published to NVD
- 2026-06-25 - Last updated in NVD database
Technical Details for CVE-2026-45757
Vulnerability Analysis
The vulnerability stems from incomplete session invalidation when an administrator deactivates idle users. Rocket.Chat exposes a users.deactivateIdle endpoint that marks accounts inactive after a configured idle period. The deactivation flow updates the user's active state but does not invalidate existing authentication tokens stored server-side. As a result, any previously issued bearer token remains valid for authenticated REST API calls.
The issue is classified under [CWE-613] Insufficient Session Expiration. Administrators relying on users.deactivateIdle to revoke access for dormant accounts receive a false assurance of access termination. The deactivated principal can continue reading channels, sending messages, querying users, and performing other actions permitted by the original token scope.
According to EPSS data published on 2026-06-25, the probability of observed exploitation is low. Exploitation requires the attacker to possess a valid token issued before deactivation, which limits opportunistic abuse but does not protect against insider misuse or token theft scenarios.
Root Cause
The root cause is a missing token revocation step in the users.deactivateIdle code path. The function marks the user record as inactive but skips the routine that removes or invalidates the user's services.resume.loginTokens entries. Authentication middleware continues to accept those tokens because the token store still contains them.
Attack Vector
The attack vector requires a user account that has been issued a valid login token and is subsequently deactivated by the idle-user automation. The actor reuses the previously stored token against any authenticated REST endpoint. No additional privileges are required beyond the original token scope. The exploitation does not require interaction with the deactivation flow itself.
The vulnerability mechanism is described in the Rocket.Chat GitHub Security Advisory GHSA-6g3w-vg5p-w892.
Detection Methods for CVE-2026-45757
Indicators of Compromise
- REST API requests authenticated with the token of a user whose active flag is false in the users collection
- Authentication events for accounts that appear in users.deactivateIdle audit logs but continue producing API traffic
- Persistent X-Auth-Token header usage from accounts flagged as idle-deactivated
Detection Strategies
- Correlate Rocket.Chat audit logs of users.deactivateIdle actions with subsequent authenticated REST traffic from the same user IDs.
- Query the Rocket.Chat database for users where active: false and services.resume.loginTokens is non-empty.
- Inspect reverse proxy or load balancer logs for API calls from accounts that should no longer have access.
Monitoring Recommendations
- Enable Rocket.Chat audit logging and forward logs to a centralized SIEM for retention and correlation.
- Alert on any authenticated API call where the underlying user record has active: false.
- Track token issuance and revocation events to establish a baseline of expected session lifecycles.
How to Mitigate CVE-2026-45757
Immediate Actions Required
- Upgrade Rocket.Chat to one of the fixed releases: 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, or 7.10.12.
- Manually clear the services.resume.loginTokens array for all users currently flagged as inactive.
- Audit recent users.deactivateIdle events and review API activity for the affected accounts.
Patch Information
Rocket.Chat released patched versions 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12. The fixes invalidate active login tokens when a user is deactivated through the idle-user workflow. Refer to the Rocket.Chat GitHub Security Advisory GHSA-6g3w-vg5p-w892 for the full advisory and commit references.
Workarounds
- Run a scheduled job that removes services.resume.loginTokens entries for users with active: false until the upgrade is complete.
- Disable the users.deactivateIdle automation and perform deactivations through the standard admin user management flow, which invalidates tokens.
- Restrict REST API access at the network layer for accounts pending deactivation review.
# Example MongoDB command to clear login tokens for deactivated users
mongo rocketchat --eval 'db.users.updateMany({ active: false }, { $set: { "services.resume.loginTokens": [] } })'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
