CVE-2026-29197 Rocket.Chat CVE debrief

Who should care

Defenders and administrators of Rocket.Chat deployments should assess their exposure and verify if their versions are affected by this vulnerability. They should also review user permissions and monitor for potential unauthorized access to apps-engine logs.

Why it matters

CVE-2026-29197 is a medium-severity vulnerability in Rocket.Chat that allows authenticated users to read apps-engine logs without proper permissions. Defenders should verify exposure, assess impact, and adjust user permissions to mitigate potential risks.

• Potential unauthorized access to sensitive logs
• Need to verify exposure and assess impact on Rocket.Chat deployments
• Requires review and adjustment of user permissions for affected endpoints

Technical summary

The vulnerability exists in the /api/apps/logs and /api/apps/:id/logs endpoints due to a typo in the required permission check. This allows authenticated users without the proper permissions to read apps-engine logs in Rocket.Chat versions before 8.4.0, 8.3.2, 8.2.2, 8.1.3, 8.0.4, 7.13.6, 7.12.7, 7.11.7, and 7.10.10. Affected deployments should review user permissions and monitor for potential unauthorized access to apps-engine logs. Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their Rocket.Chat deployments.

Defensive priority

Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their Rocket.Chat deployments, especially for versions prior to the patched releases.

Recommended defensive actions

• Verify Rocket.Chat version and assess exposure
• Review and adjust user permissions for /api/apps/logs and /api/apps/:id/logs endpoints
• Monitor for potential unauthorized access to apps-engine logs
• Confirm whether affected Rocket.Chat deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the affected versions and the nature of the vulnerability. However, additional information on potential exploitation or specific impacts is limited. Defenders should verify Rocket.Chat versions, assess exposure, and review user permissions for /api/apps/logs and /api/apps/:id/logs endpoints. Limited source detail exists on actual exploitation or specific log access patterns.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.