CVE-2026-49278: Rocket.Chat Visitor Token Exposure in API Response

Technical summary

The vulnerability exists in the visitors.info REST API endpoint (documented at https://developer.rocket.chat/apidocs/get-visitor-information-by-id-1) across multiple Rocket.Chat versions. When querying visitor information by ID, the API response includes authentication tokens that should not be exposed. This violates API security best practices: tokens must never appear in response bodies and should only be transmitted via secure channels (HTTP headers, secure cookies) with appropriate protections. The issue affects versions prior to 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12. Remediation removes token data from API responses entirely.

Business impact

Token leakage in API responses creates a credential exposure risk that could undermine access controls. An authenticated admin querying visitor data now captures tokens that may grant broader access than intended. In multi-team or multi-organization deployments, exposed tokens could facilitate lateral movement or unauthorized access to other communication channels. The risk is compounded in environments with shared administrative accounts or insufficient token rotation policies.

Affected systems

Rocket.Chat open-source communication platform installations running unpatched versions: 8.4.x (before 8.4.2), 8.3.x (before 8.3.4), 8.2.x (before 8.2.4), 8.1.x (before 8.1.5), 8.0.x (before 8.0.6), 7.13.x (before 7.13.8), and 7.10.x (before 7.10.12). Organizations running version 8.5.0 or later are unaffected. Self-hosted and on-premises Rocket.Chat deployments are the primary concern, though managed instances should verify their version status.

Exploitability

Exploitation requires administrative or API-privileged credentials—this is not exploitable by unauthenticated attackers. However, the barrier is the privileged user, not the vulnerability itself. Once a high-privilege account is compromised or an insider has access, extracting visitor tokens requires only a standard API call to visitors.info. The CVSS score of 6.7 reflects the requirement for elevated privileges but acknowledges the high confidentiality and integrity impact of exposed tokens. No public exploit code is known to exist; the vulnerability is a logical flaw in API response handling.

Remediation

Upgrade Rocket.Chat to a patched version: 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, or 7.10.12 depending on your current release line. Patched versions remove tokens from the visitors.info API response entirely. For organizations unable to patch immediately, restrict API access to the visitors.info endpoint to strictly necessary administrative accounts and monitor access logs for unusual queries.

Patch guidance

Rocket.Chat provides patched versions across eight release branches. Identify your current version and select the matching patch: if you run 8.4.x, upgrade to 8.4.2 or higher; if 8.3.x, upgrade to 8.3.4 or higher, etc. Test patches in a staging environment before production deployment. Consult the official Rocket.Chat release notes to verify no breaking changes affect your deployment. Organizations on very old versions (earlier than 7.10) should plan an upgrade path and consider whether extended support options are available.

Detection guidance

Search API access logs for calls to the /api/v1/visitors.info endpoint, particularly those made by administrative accounts. Examine response payloads for leaked tokens—they typically appear as Bearer tokens or session identifiers in JSON responses. Monitor for repeated or automated queries to this endpoint that may indicate token harvesting. Implement network-level detection to flag responses containing authentication credentials. In Rocket.Chat audit logs, look for visitor information lookups paired with access from external systems or unusual IP addresses.

Why prioritize this

Although CVSS 6.7 (MEDIUM) reflects the privilege requirement, this vulnerability should be prioritized for patching because it directly leaks authentication tokens—a critical asset in any security posture. Token exposure is a persistent threat; leaked tokens can be reused until rotated or revoked. The barrier to exploitation (admin access) is lower in smaller organizations or those with shared admin credentials. If your Rocket.Chat instance handles sensitive communications, visitor tokens must be protected.

Risk score, explained

CVSS 3.1 score of 6.7 is driven by: (1) High privilege requirement (PR:H)—reduces attack complexity; (2) Network-adjacent vector (AV:N)—remotely exploitable; (3) High confidentiality impact (C:H)—tokens are secrets; (4) High integrity impact (I:H)—stolen tokens enable unauthorized actions; (5) Low availability impact (A:L). The score does not account for the rarity of the vulnerability in the wild or business context; it reflects the technical severity of exposing authentication material to a privileged user.

Frequently asked questions