CVE-2026-75575 RocketChat CVE debrief

Who should care

Defenders responsible for Rocket.Chat deployments should assess exposure and prioritize verification and mitigation to prevent potential abuse of the sendForgotPasswordEmail Meteor method.

Why it matters

CVE-2026-75575 is a vulnerability in Rocket.Chat that allows an unauthenticated caller to invoke the sendForgotPasswordEmail Meteor method without a DDP rate limit, potentially leading to abuse and denial-of-service. Defenders should prioritize verifying exposure and implementing compensating controls.

• Potential for unbounded volume of reset mail to be sent from the deployment's mail sender
• Ability for an attacker to probe addresses at scale using the method's response
• Potential for denial-of-service or resource exhaustion due to excessive mail sending
• Need for verification of Rocket.Chat deployment exposure and implementation of compensating controls

Technical summary

The sendForgotPasswordEmail Meteor method in Rocket.Chat is exposed without a DDP rate limit, allowing an unauthenticated caller to invoke it repeatedly, potentially leading to an unbounded volume of reset mail at a chosen address. This vulnerability enables an attacker to probe addresses at scale using the method's response, which indicates the presence of an account. The method's lack of rate limiting can lead to denial-of-service or resource exhaustion due to excessive mail sending. Defenders should prioritize verifying exposure and implementing compensating controls to limit abuse of the sendForgotPasswordEmail Meteor method in Rocket.Chat deployments. The CVE record and NVD entry provide details on the

Defensive priority

Defenders should prioritize verifying exposure and implementing compensating controls to limit abuse of the sendForgotPasswordEmail Meteor method in Rocket.Chat deployments.

Recommended defensive actions

• Verify Rocket.Chat deployment exposure to the vulnerable sendForgotPasswordEmail Meteor method
• Implement rate limiting or monitoring for the sendForgotPasswordEmail Meteor method
• Review and update Rocket.Chat to a version that registers a DDP rate limiting rule for the method
• Consider compensating controls to limit abuse of the sendForgotPasswordEmail Meteor method
• Review relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Rocket.Chat, which allows an unauthenticated caller to invoke the sendForgotPasswordEmail Meteor method without a DDP rate limit, potentially leading to unbounded volume of reset mail.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.