CVE-2026-32995

Technical summary

CVE-2026-32995 exploits the autoTranslate.translateMessage DDP method in affected Rocket.Chat versions. The method accepts a client-supplied IMessage object and forwards it to translateMessage() without calling Meteor.userId() validation or verifying the requesting user's membership in the message's source room. Because DDP (Distributed Data Protocol) requires only basic authentication to establish a connection, any authenticated user can craft a malicious DDP call specifying an arbitrary message ID and retrieve its plaintext content, circumventing room-level access controls. This is particularly severe in environments using private channels, direct messages, or end-to-end encryption, where the vulnerability exposes content that should be inaccessible.

Business impact

This vulnerability enables unauthorized information disclosure at scale within Rocket.Chat deployments. Attackers with valid credentials can systematically extract sensitive communications: confidential business discussions in private channels, personal messages between employees, and legally protected conversations. For regulated organizations (finance, healthcare, legal services), the ability to read encrypted messages post-facto undermines data protection compliance (HIPAA, GDPR, SOX). The breach of trust—that private channels are actually private—can damage client relationships and internal team confidence. Organizations relying on Rocket.Chat for sensitive workflows face both immediate data loss and downstream liability if communications are exfiltrated.

Affected systems

All Rocket.Chat versions prior to 8.5.0 are affected. Specifically, versions <8.4.2, <8.3.4, <8.2.4, <8.1.5, <8.0.5, <7.13.8, and <7.10.12 are vulnerable. Instances on any of these versions with network-accessible DDP endpoints and at least one authenticated user account are at risk. Self-hosted and SaaS Rocket.Chat deployments are equally vulnerable if running unpatched versions.

Exploitability

Exploitability is moderate to high. The attack requires only valid Rocket.Chat credentials (which are easy to obtain if the instance allows registration or if an attacker already has a legitimate user account). No additional privileges, user interaction, or special network position are required; the CVSS vector confirms network-level accessibility with no authentication escalation needed beyond a basic DDP session. However, the attacker must know or guess message IDs to target specific messages, which adds minor friction. Automated enumeration of message IDs across time ranges is feasible, making systematic extraction practical. No known public exploit code has been disclosed as of this writing, but the attack surface is straightforward enough that proof-of-concept tools could be rapidly developed.

Remediation

Apply patches immediately: upgrade to Rocket.Chat 8.5.0 or later, or apply backports to supported versions (8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.5, 7.13.8, or 7.10.12). Verify against the official Rocket.Chat security advisory for exact patch URLs and installation steps. For instances unable to patch immediately, consider: restricting DDP access via network-level controls (firewall rules limiting DDP connections to trusted IPs), disabling the autoTranslate feature if not in use, and auditing user account creation to minimize credential compromise. These are temporary mitigations only and do not eliminate the underlying vulnerability.

Patch guidance

Rocket.Chat has released patched versions for each supported branch. Upgrade following the release notes for your current version to the specified minimum patched version. Test upgrades in a staging environment first, as Rocket.Chat upgrades can affect connected clients and integrations. For organizations on extended support or legacy versions not listed, contact Rocket.Chat support to confirm patch availability. Document the pre-upgrade state of user accounts and message histories in case rollback diagnostics are needed. Post-upgrade, verify that DDP connectivity is restored and the autoTranslate feature functions normally if enabled.

Detection guidance

Monitor DDP connections and method calls for unusual patterns: look for authentication logs showing a single user making an unusually high volume of autoTranslate.translateMessage calls, especially across multiple rooms or with message IDs that the user should not have access to. Enable Rocket.Chat audit logging if available and parse logs for repeated calls to the autoTranslate method from non-administrative users. Network detection can identify DDP traffic spikes or repeated connections from the same source IP. Threat hunters should cross-reference DDP audit logs with room membership lists to identify calls originating from users who do not belong to the rooms where the targeted messages originated. If end-to-end encryption is enabled, baseline the read patterns of E2EE messages and flag anomalies.

Why prioritize this

This vulnerability merits immediate patching because it enables silent, unauthorized read access to all message types including encrypted communications, affects any authenticated user without special privilege, and is trivially exploitable once message IDs are known. The scope of exposure is organization-wide, affecting all rooms and users. Organizations in regulated industries or those storing highly sensitive IP, legal, or personal data should treat this as critical. Even if DDP is not actively used by all clients, the presence of a single exposed DDP listener creates risk.

Risk score, explained

The CVSS 3.0 score of 7.5 (HIGH) reflects high-impact confidentiality loss with no integrity or availability impact. The attack vector is network-based, attack complexity is low, and no privileges or user interaction are required beyond a valid DDP session. While the confidentiality impact is severe (complete read access to messages), the attack does not escalate to system compromise, lateral movement, or data modification. The score appropriately reflects a serious information disclosure vulnerability that falls short of critical severity because exploitation is confined to message content retrieval and does not enable account takeover, code execution, or system-wide outages.

Frequently asked questions