CVE-2026-72918 RocketChat CVE debrief

Who should care

Defenders responsible for Rocket.Chat deployments, especially those with untrusted or external users, should assess exposure and apply patches to prevent potential impersonation and unauthorized message creation.

Why it matters

CVE-2026-72918 is a medium-severity vulnerability in Rocket.Chat that allows authenticated users to write arbitrary notification bodies. Defenders should verify exposure, especially in deployments with untrusted users, and apply patches to prevent impersonation and unauthorized message creation.

• Potential impersonation of users via fake messages
• Unauthorized message creation in Rocket.Chat deployments
• Verification of user authentication and authorization settings required
• Patching Rocket.Chat to prevent exploitation

Technical summary

The stream-notify-user stream in the Rocket.Chat WebSocket protocol allows an authenticated user to write arbitrary notification bodies because the sender is not checked. This issue enables a user to create a fake message in another user's open chat. Rocket.Chat has released fixed versions to address this issue. Defenders should assess exposure, especially in deployments with untrusted users, and apply patches to prevent impersonation and unauthorized message creation. Affected versions include those prior to 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1.

Defensive priority

Defenders should prioritize verifying exposure in Rocket.Chat deployments, especially those with untrusted or external users, and apply the provided patches to prevent potential impersonation and unauthorized message creation.

Recommended defensive actions

• Verify Rocket.Chat version and apply patches if necessary
• Review user authentication and authorization settings
• Monitor for suspicious activity in Rocket.Chat deployments
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. A reference to the Rocket.Chat security advisory is also available. Defenders should verify Rocket.Chat deployments, especially those with untrusted or external users, and apply patches to prevent potential impersonation and unauthorized message creation. Evidence is limited to public sources; further verification is recommended.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.