CVE-2026-72919 RocketChat CVE debrief

Who should care

Rocket.Chat administrators and users with create-team permissions should assess exposure and verify their version of Rocket.Chat. Additionally, security teams and platform operators should review the vulnerability's impact on their environments and take necessary precautions to prevent exploitation. This includes restricting create-team permissions to necessary users and monitoring for suspicious channel conversions.

Why it matters

CVE-2026-72919 is a medium-severity vulnerability in Rocket.Chat's channels.convertToTeam REST endpoint. Defenders should prioritize verifying exposure in Rocket.Chat deployments, especially those with public channels and users with create-team permissions. The vulnerability allows an authenticated user to convert an unrelated public channel, potentially disrupting communication channels. While exploitation is not confirmed, defenders should verify their Rocket.Chat version and restrict create-team permissions to necessary users.

• Verify Rocket.Chat version and assess exposure to this vulnerability
• Restrict create-team permissions to necessary users to prevent unauthorized channel conversions
• Monitor for suspicious channel conversions that could indicate exploitation attempts

Technical summary

The channels.convertToTeam REST endpoint in Rocket.Chat allows an authenticated registered user with create-team permission to convert an unrelated public channel by supplying channelName instead of channelId. This issue arises because the edit-room permission is checked only for channelId. The vulnerability has been fixed in versions 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1. Defenders should prioritize verifying exposure in Rocket.Chat deployments, especially those with public channels and users with create-team permissions.

Defensive priority

Defenders should prioritize verifying exposure in Rocket.Chat deployments, especially those with public channels and users with create-team permissions.

Recommended defensive actions

• Verify Rocket.Chat version and assess exposure to this vulnerability
• Restrict create-team permissions to necessary users to prevent unauthorized channel conversions
• Monitor for suspicious channel conversions that could indicate exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. However, the corpus does not establish versions, exploitation, impact, or remediation beyond the provided information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.