CVE-2026-72919: Rocket.Chat Auth Bypass Vulnerability

CVE-2026-72919 Overview

CVE-2026-72919 is a broken access control vulnerability [CWE-862] in Rocket.Chat, an open-source communications platform. The flaw resides in the channels.convertToTeam REST endpoint. An authenticated user with the create-team permission can convert an unrelated public channel into a team by supplying channelName instead of channelId. The edit-room permission check is applied only when channelId is provided, leaving the channelName code path unchecked.

Rocket.Chat published fixes in versions 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1.

Critical Impact
Any authenticated user with the create-team permission can convert public channels they do not own or administer, altering channel state and integrity across the workspace.

Affected Products

Rocket.Chat versions prior to 7.10.14
Rocket.Chat 8.0.x through 8.6.x prior to patched releases (8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, 8.6.1)
Self-hosted and on-premises Rocket.Chat deployments exposing the REST API

Discovery Timeline

2026-08-10 - CVE-2026-72919 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-72919

Vulnerability Analysis

The vulnerability affects the channels.convertToTeam REST endpoint in Rocket.Chat. The endpoint accepts either channelId or channelName to identify the target channel. The server-side authorization logic invokes hasPermissionAsync for the edit-room permission only when channelId is supplied. When a caller submits channelName, the endpoint skips the room-level permission check and proceeds with the conversion.

An authenticated attacker holding only the create-team permission can therefore convert arbitrary public channels into teams. This modifies channel type and metadata, disrupts channel administration, and can grant the attacker team-level control over rooms they were never authorized to manage.

Root Cause

The root cause is a missing authorization check [CWE-862] on one branch of the input parameter handling. The endpoint performs permission validation asymmetrically: channelId triggers an edit-room permission check, while channelName does not. The patch introduces hasAllPermissionAsync and applies uniform permission validation regardless of which identifier the caller uses.

Attack Vector

Exploitation requires network access to the Rocket.Chat REST API and an authenticated account with the create-team permission, which is granted to standard users in default deployments. The attacker issues a REST request to channels.convertToTeam supplying the channelName parameter for a public channel they do not administer. No user interaction is required.

typescript

// Patch: apps/meteor/server/api/v1/channels.ts
 import { getUserMentionsByChannel } from '../../../app/mentions/server/methods/getUserMentionsByChannel';
 import { settings } from '../../../app/settings/server';
 import { normalizeMessagesForUser } from '../../../app/utils/server/lib/normalizeMessagesForUser';
-import { hasPermissionAsync } from '../../lib/authorization/hasPermission';
+import { hasAllPermissionAsync, hasPermissionAsync } from '../../lib/authorization/hasPermission';
 import { eraseRoom } from '../../lib/eraseRoom';
 import { findUsersOfRoom } from '../../lib/findUsersOfRoom';
 import { openRoom } from '../../lib/openRoom';

Source: Rocket.Chat commit 175a19c

typescript

// Patch: apps/meteor/server/api/v1/teams.ts
 import { canAccessRoomAsync } from '../../../app/authorization/server';
 import { settings } from '../../../app/settings/server';
-import { hasPermissionAsync, hasAtLeastOnePermissionAsync } from '../../lib/authorization/hasPermission';
+import { hasPermissionAsync, hasAtLeastOnePermissionAsync, hasAllPermissionAsync } from '../../lib/authorization/hasPermission';
 import { eraseRoom } from '../../lib/eraseRoom';
 import { removeUserFromRoom } from '../../lib/rooms/removeUserFromRoom';
 import type { ExtractRoutesFromAPI } from '../ApiClass';

Source: Rocket.Chat pull request #41206

Detection Methods for CVE-2026-72919

Indicators of Compromise

Unexpected POST requests to /api/v1/channels.convertToTeam containing a channelName parameter
Public channels converted to teams without a corresponding administrative action in audit logs
Team creation events initiated by users lacking room ownership over the source channel
Rocket.Chat audit entries showing channel-converted-to-team actions from low-privilege accounts

Detection Strategies

Parse Rocket.Chat REST access logs for calls to channels.convertToTeam and correlate the requester against the source channel owner or administrator set
Alert on any conversion event where the acting user holds only create-team without edit-room on the target channel
Baseline the volume of channel-to-team conversions per user and flag statistical outliers

Monitoring Recommendations

Forward Rocket.Chat application and API logs to a centralized log platform for retention and query
Monitor role and permission changes for the create-team privilege to identify overly permissive assignments
Track team creation events and reconcile them against expected administrative workflows

How to Mitigate CVE-2026-72919

Immediate Actions Required

Upgrade Rocket.Chat to a patched release: 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, or 8.6.1
Audit which roles hold the create-team permission and remove it from roles that do not require team creation
Review recent conversions of channels to teams and revert unauthorized changes
Restrict REST API exposure to trusted networks where operationally feasible

Patch Information

Rocket.Chat addressed the issue in commit 175a19c4151f41910499ef37df54f58022276d12 under pull request #41206. The fix applies uniform permission checks to both the channelId and channelName branches of channels.convertToTeam. Full details are documented in the GitHub Security Advisory GHSA-4mvx-9h2h-hmg3.

Workarounds

Temporarily remove the create-team permission from the default user role until the upgrade is applied
Place the Rocket.Chat REST API behind a reverse proxy that blocks channels.convertToTeam requests originating from non-administrative accounts
Increase logging verbosity on the REST API to detect exploitation attempts during the remediation window

bash

# Verify installed Rocket.Chat version and confirm it matches a patched release
curl -s https://<rocketchat-host>/api/info | jq '.version'

# Example: block channels.convertToTeam at an upstream nginx proxy during remediation
# location = /api/v1/channels.convertToTeam { return 403; }