CVE-2026-65645: Rocket.Chat Information Disclosure Flaw

CVE-2026-65645 Overview

CVE-2026-65645 is a NoSQL injection vulnerability in Rocket.Chat's Meteor Distributed Data Protocol (DDP) methods getThreadsList and getThreadMessages. These methods accept rid and tmid parameters as raw, untyped values without schema validation. A low-privilege authenticated attacker can substitute a MongoDB operator object such as {"$gt": "4"} in place of a string room or message identifier. The authorization check resolves against a room the attacker already accesses, while the downstream query fans out across all rooms. The result is disclosure of private thread parents and their full reply content to any authenticated user.

Critical Impact
Any authenticated Rocket.Chat user can read private thread messages across the entire workspace by injecting MongoDB operators into DDP method parameters.

Affected Products

Rocket.Chat versions prior to 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8
Rocket.Chat 7.x versions prior to 7.10.15
Meteor DDP getThreadsList and getThreadMessages methods

Discovery Timeline

2026-08-21 - CVE-2026-65645 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-65645

Vulnerability Analysis

The vulnerability is a NoSQL injection classified under [CWE-20] Improper Input Validation. Rocket.Chat exposes real-time functionality through Meteor's DDP protocol. Two DDP methods, getThreadsList and getThreadMessages, receive client-supplied rid (room ID) and tmid (thread message ID) parameters without type checking.

MongoDB queries in Node.js accept plain JavaScript objects. When a parameter passes directly into a query filter, an attacker can substitute a query operator object for the expected string. A payload like {"$gt": "4"} matches every document whose identifier sorts greater than the string "4", effectively bypassing the room scope.

The REST equivalent chat.getThreadsList received an AJV schema fix requiring rid: {type: 'string'} in version 5.0 following HackerOne report #1446767. The corresponding DDP method was not patched at that time and remained exploitable until the fixes tracked in this CVE.

Root Cause

The root cause is missing schema validation on DDP method parameters. The authorization step evaluates access against a room the attacker legitimately joins, but the query stage uses the attacker-controlled object directly as a MongoDB filter. Authorization and data retrieval operate on inconsistent inputs, breaking the access-control invariant.

Attack Vector

An authenticated user with any workspace access invokes the DDP method getThreadsList or getThreadMessages and supplies a MongoDB operator object in place of the string identifier. The server returns thread parent messages and replies from rooms the attacker is not a member of, including private channels and direct messages containing thread activity.

Refer to the GitHub Pull Request #41814 and HackerOne Report #3852135 for the technical fix and disclosure record.

Detection Methods for CVE-2026-65645

Indicators of Compromise

DDP method calls to getThreadsList or getThreadMessages where the rid or tmid parameter is a JSON object rather than a string.
WebSocket frames containing MongoDB operator keys such as $gt, $ne, $regex, or $in inside method parameter payloads.
Unusually large response payloads from thread-related DDP methods returning content from multiple rooms.

Detection Strategies

Parse Rocket.Chat DDP WebSocket traffic and alert when method parameters for thread endpoints deserialize to objects instead of strings.
Correlate authenticated sessions that access thread data from rooms where the user has no membership record.
Review Rocket.Chat application logs for repeated method invocations from a single account against thread endpoints.

Monitoring Recommendations

Enable verbose DDP method logging on Rocket.Chat servers and forward logs to a central analytics platform.
Baseline normal thread-access volume per user and alert on statistical deviations.
Monitor egress traffic from Rocket.Chat instances for large outbound responses following authenticated DDP sessions.

How to Mitigate CVE-2026-65645

Immediate Actions Required

Upgrade Rocket.Chat to 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, or 7.10.15, matching your current release branch.
Audit application logs for prior invocations of getThreadsList and getThreadMessages with non-string parameters.
Rotate credentials and review private thread content that may have been exposed to low-privilege accounts.

Patch Information

The fix adds strict schema validation on the DDP methods, mirroring the AJV validation already applied to the REST route chat.getThreadsList in version 5.0. Details are available in GitHub Pull Request #41814.

Workarounds

Restrict DDP access at the network layer to trusted clients until the patched version is deployed.
Deploy a reverse proxy rule that inspects DDP WebSocket frames and drops method calls whose rid or tmid parameters are not JSON strings.
Reduce the number of low-privilege accounts on the workspace and disable self-registration during the remediation window.

bash

# Example: verify installed Rocket.Chat version before and after upgrade
curl -s https://your-rocketchat.example.com/api/info | jq '.version'

# Docker upgrade example to a patched release
docker pull rocketchat/rocket.chat:8.8.0
docker stop rocketchat && docker rm rocketchat
docker run -d --name rocketchat --env-file .env -p 3000:3000 rocketchat/rocket.chat:8.8.0