CVE-2026-48929: Unauthenticated File Deletion in Rocket.Chat – Patch Now

Technical summary

The vulnerability resides in the deleteFileMessage Meteor method, which lacks proper authentication enforcement. When invoked over an unauthenticated DDP (Distributed Data Protocol) WebSocket connection, Meteor.userId() correctly returns null, but the application fails to reject the operation at that point. Instead, the null value bypasses the authorization logic, and execution proceeds unconditionally to FileUpload.getStore('Uploads').deleteById(fileID), which removes the file from both storage and database. File IDs are readily enumerable from public channel message payloads and direct download URLs, making exploitation straightforward. The root cause is inadequate input validation and authentication assertion before a privileged file operation.

Business impact

Unplanned file deletion can disrupt collaboration, destroy audit trails, and compromise data integrity. For organizations using Rocket.Chat as a primary communication and document repository, this vulnerability enables denial-of-service attacks against stored content. If sensitive files (contracts, configurations, credentials) are discoverable in public channels, adversaries can selectively erase evidence or critical business documents. The lack of a KEV listing and zero-day status means exploitation may already be in the wild before patches are widely deployed.

Affected systems

Rocket.Chat versions 8.5.0 and earlier across all branches are at risk: <8.5.1, <8.4.4, <8.3.6, <8.2.6, <8.1.6, <8.0.7, <7.13.9, and <7.10.13. Organizations running self-hosted Rocket.Chat instances are directly affected. Cloud-hosted Rocket.Chat customers depend on vendor patching but should verify their instance version. The vulnerability applies regardless of deployment architecture (Docker, Kubernetes, bare metal) as long as the application version falls within the affected range.

Exploitability

Exploitation requires only network access to the Rocket.Chat WebSocket endpoint and knowledge of a valid file ID. No credentials, MFA bypass, or social engineering is necessary. File IDs leak passively through public channel archives, making reconnaissance trivial. An attacker can automate deletion of multiple files in seconds. The low barrier to entry, combined with high impact, earns this a CVSS 3.0 score of 7.5 (HIGH). The lack of active exploitation tracking (KEV status is false) does not imply the vulnerability is difficult to exploit—only that it has not yet been formally cataloged as widely weaponized by CISA.

Remediation

Upgrade to patched versions: 8.5.1 or later for the main branch, 8.4.4 for 8.4.x, 8.3.6 for 8.3.x, 8.2.6 for 8.2.x, 8.1.6 for 8.1.x, 8.0.7 for 8.0.x, 7.13.9 for 7.13.x, and 7.10.13 for 7.10.x. Organizations unable to patch immediately should restrict WebSocket access at the network perimeter (firewall rules, reverse proxy authentication) and audit file deletion logs for suspicious activity. Consider moving sensitive files to access-restricted channels and implementing file retention policies.

Patch guidance

Prioritize patching Rocket.Chat instances in order of network exposure and data sensitivity. Cloud-hosted instances should receive patches automatically; verify via the admin console that your version matches the advisory. Self-hosted deployments should follow the official Rocket.Chat release notes and upgrade via their standard deployment pipeline (Helm, Docker Compose, etc.). Test patches in a non-production environment first to ensure compatibility with custom integrations or plugins. After patching, review audit logs for evidence of unauthorized file deletion dating back to the vulnerability disclosure.

Detection guidance

Monitor Rocket.Chat server logs for deleteFileMessage method calls from unauthenticated or null-userId sessions. Search for WebSocket connection patterns that lack valid authentication tokens before file deletion operations. Network-level detection: flag outbound WebSocket frames containing deleteFileMessage followed by a fileID parameter from public channel contexts. Endpoint detection and response (EDR) tools should alert on unexpected file deletion from Rocket.Chat storage directories. Perform a manual audit of recently deleted files in your Rocket.Chat database to identify suspicious patterns (bulk deletions, deletions of sensitive file types, deletions by unknown requesters).

Why prioritize this

This vulnerability combines high impact (permanent data loss), trivial exploitability (no authentication required), and ease of discovery (file IDs in public channels). While not yet cataloged as actively exploited, the low bar to weaponization makes it an urgent priority for any organization relying on Rocket.Chat for business-critical communication or file storage. Delaying patching leaves systems vulnerable to both opportunistic attacks and targeted data destruction.

Risk score, explained

CVSS 3.0 assigns a score of 7.5 (HIGH) based on: Attack Vector=Network (unauthenticated internet access), Attack Complexity=Low (no special conditions), Privileges Required=None (no credentials needed), User Interaction=None (automatic exploitation possible), Scope=Unchanged, Confidentiality=None (not a data leak), Integrity=None (no tampering with existing data), and Availability=High (files are permanently deleted). The score reflects the ease and impact of exploitation but omits reconnaissance difficulty and real-world blast radius, both of which strengthen the case for urgent remediation.

Frequently asked questions