CVE-2026-48616: Rocket.Chat Auth Bypass Vulnerability

CVE-2026-48616 Overview

CVE-2026-48616 is an access control vulnerability [CWE-284] in Rocket.Chat's Livechat file download endpoint. The flaw resides in the protected file download route at /file-upload/:fileId/:name. The authorization logic accepts rc_room_type=l together with rc_rid and rc_token parameters but fails to confirm that rc_rid matches the room identifier of the requested file. Combined with predictable sequential MongoDB identifiers for :fileId and an unvalidated :name parameter, unauthenticated attackers can enumerate and download every uploaded file. The issue affects Rocket.Chat versions prior to 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, 7.13.9, and 7.10.13.

Critical Impact
Unauthenticated attackers can enumerate and download all files uploaded to a Rocket.Chat workspace, exposing sensitive customer, business, and operational data.

Affected Products

Rocket.Chat versions earlier than 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, and 8.0.7
Rocket.Chat versions earlier than 7.13.9 and 7.10.13
Deployments exposing the Livechat file download endpoint /file-upload/:fileId/:name

Discovery Timeline

2026-06-17 - CVE-2026-48616 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-48616

Vulnerability Analysis

The vulnerability stems from incomplete authorization checks on the Livechat file download endpoint. Rocket.Chat allows Livechat visitors to retrieve files attached to their conversations through /file-upload/:fileId/:name. Authorization is granted when the request supplies rc_room_type=l along with rc_rid (room identifier) and rc_token (visitor token). The server validates that the supplied rc_rid and rc_token pair represents a legitimate Livechat session but never confirms that the file referenced by :fileId actually belongs to that room. An attacker who controls any single Livechat session can therefore request any file ID and receive its contents.

The weakness is amplified by predictable resource identifiers. Rocket.Chat stores uploaded files in MongoDB using sequential ObjectId values, which an attacker can enumerate. The :name segment is not validated against stored metadata, so any value satisfies the route. Together, these conditions allow systematic discovery and exfiltration of every uploaded file in the workspace.

Root Cause

The root cause is broken access control [CWE-284]: the authorization handler validates the requester's Livechat token but omits a binding check between the requested file's rid field and the rc_rid claim in the request. Authorization is treated as a global capability rather than a per-resource decision.

Attack Vector

Exploitation requires only network access to the Rocket.Chat instance. An attacker initiates a Livechat session to obtain valid rc_rid and rc_token values, then iterates through sequential fileId values against /file-upload/:fileId/:name using an arbitrary file name. The server returns each file regardless of whether it belongs to the attacker's room. No authentication, user interaction, or elevated privileges are required.

The vulnerability is described in the GitHub Rocket.Chat PR 40889 and the HackerOne Report #3687142. No verified public exploit code is available at the time of writing.

Detection Methods for CVE-2026-48616

Indicators of Compromise

High volume of GET requests to /file-upload/:fileId/:name from a single source IP or a small set of Livechat tokens.
Sequential or near-sequential fileId values appearing in access logs over a short time window.
Repeated 200 OK responses to file download requests where the rc_rid parameter is identical across requests for files belonging to many different rooms.

Detection Strategies

Parse reverse-proxy and Rocket.Chat application logs for requests to /file-upload/ and correlate the supplied rc_rid with the rid field stored on the file document in MongoDB.
Alert on Livechat visitor tokens that download files at a rate inconsistent with normal user behavior.
Hunt for rc_room_type=l requests originating from clients that never opened a Livechat conversation in the web widget.

Monitoring Recommendations

Forward Rocket.Chat NGINX or application access logs to a centralized logging platform for retention and correlation.
Track 200-status responses on the /file-upload/ route per visitor token and per source IP and define thresholds for anomalous download counts.
Monitor outbound bandwidth from the Rocket.Chat host for unexpected spikes that correlate with Livechat traffic.

How to Mitigate CVE-2026-48616

Immediate Actions Required

Upgrade Rocket.Chat to 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, 7.13.9, or 7.10.13 depending on the deployed release branch.
Audit access logs for the /file-upload/ endpoint to determine whether mass enumeration has already occurred.
Rotate or invalidate active Livechat visitor tokens following the upgrade.

Patch Information

The fix is implemented in GitHub Rocket.Chat PR 40889, which adds a check confirming that the rc_rid supplied in the request matches the rid recorded on the requested file before authorizing the download. Additional context is available in HackerOne Report #3687142.

Workarounds

Restrict access to /file-upload/ at a reverse proxy and require an authenticated session for all file retrievals until the patch is applied.
Disable the Livechat feature in administrative settings if the workspace does not rely on it.
Place the Rocket.Chat instance behind a web application firewall rule that blocks requests to /file-upload/ containing rc_room_type=l from untrusted networks.

bash

# Example NGINX block restricting Livechat file downloads to internal networks
location ~ ^/file-upload/ {
    if ($arg_rc_room_type = "l") {
        # Allow only internal subnets while patching is in progress
        allow 10.0.0.0/8;
        deny all;
    }
    proxy_pass http://rocketchat_upstream;
}