CVE-2026-48616 Rocket.Chat CVE debrief

Who should care

Administrators and users of Rocket.Chat, especially those using Livechat functionality, should be aware of this critical vulnerability. Immediate action is required to prevent unauthorized access to sensitive files.

Technical summary

The vulnerability exists in the file download endpoint /file-upload/:fileId/:name. The authorization mechanism uses rc_room_type=l with rc_rid and rc_token, but it fails to verify that rc_rid matches the room ID of the requested file. The fileId is sequentially generated by MongoDB, making it predictable. The name parameter can be any string, allowing attackers to discover and access files without authentication.

Defensive priority

Critical

Recommended defensive actions

• Update Rocket.Chat to version 8.5.1 or later, 8.4.4 or later, 8.3.6 or later, 8.2.6 or later, 8.1.6 or later, 8.0.7 or later, 7.13.9 or later, or 7.10.13 or later.
• Restrict access to the Livechat file download endpoint.
• Implement additional authentication and authorization checks for file downloads.
• Monitor for suspicious file access attempts.
• Review and update access controls for Livechat files.
• Consider using a Web Application Firewall (WAF) to detect and prevent exploitation attempts.

Evidence notes

The information provided is based on the CVE record and NVD details. The vulnerability was reported through HackerOne. The accuracy of this debrief relies on the information available from these sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.