CVE-2026-72918 Overview
CVE-2026-72918 is a missing authorization vulnerability [CWE-862] in Rocket.Chat, an open-source communications platform. The flaw exists in the stream-notify-user WebSocket stream, which fails to verify the sender of notification events. An authenticated user can write arbitrary notification bodies targeting other users. The client-side UI then renders an ephemeral fake message inside the victim's currently open chat window. Affected releases include all versions prior to 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1.
Critical Impact
Authenticated attackers can inject fake ephemeral messages into another user's active chat, enabling social engineering and impersonation attacks.
Affected Products
- Rocket.Chat versions prior to 7.10.14
- Rocket.Chat 8.x versions prior to 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2
- Rocket.Chat versions prior to 8.6.1
Discovery Timeline
- 2026-08-10 - CVE-2026-72918 published to NVD
- 2026-08-11 - Last updated in NVD database
Technical Details for CVE-2026-72918
Vulnerability Analysis
Rocket.Chat uses WebSocket streams to deliver real-time events between clients and the server. The stream-notify-user stream carries notifications targeted at specific users, including UI-level events that render inside open chat windows. The server does not validate that the sender of a notification event matches the identity being impersonated. Any authenticated user can publish arbitrary notification payloads to another user's stream.
The client-side UI trusts the payload and renders an ephemeral fake message in the recipient's currently open chat. Because the message appears in the correct conversation context, the victim may reasonably believe it originated from the counterparty. This mechanism enables convincing impersonation and phishing scenarios within trusted channels.
Root Cause
The root cause is a missing authorization check on the stream-notify-user WebSocket stream. The server relays notification bodies without verifying that the requesting user is authorized to send events on behalf of the claimed sender. The client renders the payload as a chat-context message without independent validation.
Attack Vector
Exploitation requires an authenticated Rocket.Chat account and network access to the server. The attacker sends a crafted WebSocket message to the stream-notify-user endpoint targeting a victim user identifier. When the victim has a chat window open, the fake ephemeral message appears within that conversation. See the GitHub Security Advisory for technical details.
Detection Methods for CVE-2026-72918
Indicators of Compromise
- Unusual volume of stream-notify-user WebSocket messages originating from non-administrative accounts.
- User reports of chat messages that disappear on refresh or that peers deny sending.
- WebSocket frames referencing user IDs that do not match the authenticated session identifier.
Detection Strategies
- Inspect Rocket.Chat server logs for stream-notify-user events where the event sender differs from the authenticated session user.
- Enable verbose WebSocket logging and correlate notification stream traffic with authenticated user sessions.
- Alert on accounts publishing notification events to a large number of distinct target user IDs in a short interval.
Monitoring Recommendations
- Monitor WebSocket connection metadata for anomalous per-user message rates on notification streams.
- Track and alert on user reports of ephemeral or unattributable in-chat messages.
- Log and review any client-server API calls that manipulate notification payloads for irregular structures.
How to Mitigate CVE-2026-72918
Immediate Actions Required
- Upgrade Rocket.Chat to a fixed version: 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, or 8.6.1.
- Audit recent WebSocket traffic on the stream-notify-user stream for signs of prior abuse.
- Notify users about the risk of spoofed ephemeral messages and advise verification through alternate channels.
Patch Information
Rocket.Chat addressed CVE-2026-72918 in versions 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1. The fix adds a server-side authorization check on the stream-notify-user stream to validate that the notification sender matches the authenticated session. Refer to the Rocket.Chat GitHub Security Advisory GHSA-27jx-236m-3f5j for full patch details.
Workarounds
- No official workaround exists; upgrading to a patched release is required.
- Restrict Rocket.Chat access to trusted authenticated users while planning the upgrade.
- Educate users to verify sensitive requests received in chat through a secondary channel until patches are applied.
# Upgrade example for a Docker-based Rocket.Chat deployment
docker pull rocketchat/rocket.chat:8.6.1
docker stop rocketchat && docker rm rocketchat
docker run --name rocketchat -d rocketchat/rocket.chat:8.6.1
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
