Rocket.Chat 8.2.0 Release Candidate 1
Approved changes feed: RSS · Atom
cpe:2.3:a:rocket.chat:rocket.chat:8.2.0:rc1:*:*:*:*:*:*
part: a version: 8.2.0 update: rc1
| Vendor | Rocket.Chat (617b1e93-7861-5e45-ab59-92186372afa4) |
|---|---|
| Product | Rocket.Chat (e5bf3e71-5ab4-55f1-a289-af2224ae2fe5) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/rocketchat/rocket.chat |
purl2cpe | 2026-06-01 10:18:04.515951 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-30833 |
vulnerable | 2026-06-08 07:57:14.320775 |
Rocket.Chat: NoSQL injection in the EE ddp-streamer-service
Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to versions 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1, and 8.2.0, a NoSQL injection vulnerability exists in Rocket.Chat's account service used in the ddp-streamer micro service that allows unauthenticated attackers to manipulate MongoDB queries during authentication. The vulnerability is located in the username-based login flow where user-supplied input is directly embedded into a MongoDB query selector without validation. An attacker can inject MongoDB operator expressions (e.g., { $regex: '.*' }) in place of a username string, causing the database query to match unintended user records. This issue has been patched in versions 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1, and 8.2.0.
Published: 2026-03-06T17:40:36.939Z
Updated: 2026-03-09T14:56:03.564Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-30831 |
vulnerable | 2026-06-08 07:57:14.316568 |
Rocket.Chat: 2FA bypass and login of deactivated users via EE ddp-streamer
Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to versions 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1, and 8.2.0, authentication vulnerabilities exist in Rocket.Chat's enterprise DDP Streamer service. The Account.login method exposed through the DDP Streamer does not enforce Two-Factor Authentication (2FA) or validate user account status (deactivated users can still login), despite these checks being mandatory in the standard Meteor login flow. This issue has been patched in versions 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1, and 8.2.0.
Published: 2026-03-06T17:40:27.824Z
Updated: 2026-03-11T03:56:34.815Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.