CVE-2026-75575: Rocket.Chat DOS Vulnerability

CVE-2026-75575 Overview

CVE-2026-75575 affects Rocket.Chat, an open source team collaboration platform. The sendForgotPasswordEmail Meteor method is exposed without a Distributed Data Protocol (DDP) rate limit, allowing unauthenticated callers to invoke it repeatedly. The method is reachable over DDP and via the HTTP route POST /api/v1/method.callAnon/sendForgotPasswordEmail. Without a DDPRateLimiter rule registered, attackers can flood arbitrary addresses with password reset messages and enumerate account types at scale. The flaw is classified under CWE-204: Observable Response Discrepancy.

Critical Impact
Unauthenticated attackers can send unbounded reset mail volume from the deployment's mail sender and enumerate accounts that authenticate through external OAuth providers.

Affected Products

Rocket.Chat server versions prior to the patched release
Deployments exposing the sendForgotPasswordEmail Meteor method
Instances with Accounts_AllowPasswordChangeForOAuthUsers disabled (enumeration vector)

Discovery Timeline

2026-08-25 - CVE-2026-75575 published to the National Vulnerability Database (NVD)
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-75575

Vulnerability Analysis

The sendForgotPasswordEmail Meteor method triggers a password reset email for any address matching an account. Because no DDPRateLimiter rule is registered for it, an unauthenticated caller may invoke it as often as desired. The method is reachable through two transport paths: the DDP WebSocket interface and the anonymous HTTP method endpoint at /api/v1/method.callAnon/sendForgotPasswordEmail.

The method returns distinguishable results based on account state. It answers true for addresses with no account and for successful sends. It answers false when the address belongs to an account authenticating through an external provider and Accounts_AllowPasswordChangeForOAuthUsers is disabled. Repeated calls therefore let a caller distinguish that specific class of account, producing an observable response discrepancy.

Root Cause

The root cause is a missing DDPRateLimiter rule registration for the sendForgotPasswordEmail Meteor method. Rocket.Chat relies on Meteor's rate-limiter framework to throttle sensitive methods, but this method was never registered with a rule. Combined with the boolean response that reflects backend account state, the absence of throttling enables both mass mail abuse and account enumeration against OAuth-linked users.

Attack Vector

An attacker sends repeated unauthenticated requests to the anonymous method endpoint with target email addresses. Each invocation either dispatches a reset email from the deployment's mail sender or returns a boolean revealing the account's authentication class. High-volume automation enables mail bombing of a chosen victim and large-scale user enumeration.

typescript

// Patch: apps/meteor/server/meteor-methods/auth/sendForgotPasswordEmail.ts
 import { Users } from '@rocket.chat/models';
 import { Accounts } from 'meteor/accounts-base';
 import { check } from 'meteor/check';
+import { DDPRateLimiter } from 'meteor/ddp-rate-limiter';
 import { Meteor } from 'meteor/meteor';

 import { SystemLogger } from '../../lib/logger/system';

Source: GitHub commit 3a61c3afe. The fix imports DDPRateLimiter and registers a rule permitting ten calls per minute per client address.

Detection Methods for CVE-2026-75575

Indicators of Compromise

High-volume POST requests to /api/v1/method.callAnon/sendForgotPasswordEmail from a single client address
Bursts of DDP method calls to sendForgotPasswordEmail without prior authentication context
Unusual outbound mail queue growth from the Rocket.Chat SMTP sender
Recipient complaints about repeated unsolicited password reset messages

Detection Strategies

Parse Rocket.Chat access logs for repeated hits to the method.callAnon path targeting sendForgotPasswordEmail
Correlate mail transfer agent (MTA) logs with application requests to identify enumeration attempts
Alert when a single source IP address generates more than a threshold count of reset requests per minute
Monitor DDP session metrics for anonymous callers issuing repeated identical method names

Monitoring Recommendations

Forward Rocket.Chat and reverse proxy logs to a centralized analytics platform for pattern analysis
Track outbound password reset email volume as a baseline metric with anomaly detection
Instrument web application firewall (WAF) rules to count and rate-limit anonymous method calls

How to Mitigate CVE-2026-75575

Immediate Actions Required

Upgrade Rocket.Chat to a version that registers the DDPRateLimiter rule for sendForgotPasswordEmail
Apply upstream rate limiting at the reverse proxy or WAF for the /api/v1/method.callAnon/ route
Review recent mail sender logs for evidence of abuse and notify affected recipients

Patch Information

Rocket.Chat published the fix in GitHub commit 3a61c3afe, which registers a DDPRateLimiter rule permitting ten calls per minute per client address. Refer to the GitHub Security Advisory GHSA-7c6v-m68v-v73r and the VulnCheck Rocket.Chat Advisory for full remediation guidance.

Workarounds

Enforce request-per-minute limits on /api/v1/method.callAnon/sendForgotPasswordEmail at an upstream proxy such as NGINX or HAProxy
Require CAPTCHA or proof-of-work on the password reset user interface flow where feasible
Set Accounts_AllowPasswordChangeForOAuthUsers consistently across the deployment to reduce the enumeration signal
Restrict anonymous method call endpoints via network policy where the collaboration server is only used internally

bash

# Example NGINX rate limit for the anonymous method endpoint
limit_req_zone $binary_remote_addr zone=rc_reset:10m rate=10r/m;

location /api/v1/method.callAnon/sendForgotPasswordEmail {
    limit_req zone=rc_reset burst=5 nodelay;
    proxy_pass http://rocketchat_upstream;
}