CVE-2026-55762: Rocket.Chat Workspace Deregistration Authorization Bypass – CVSS 8.1 Critical Patch

Technical summary

The POST /api/v1/fingerprint endpoint enforces authentication (authRequired: true) but lacks authorization checks (missing authz logic). CWE-862 (Missing Authorization) permits any authenticated principal to invoke the setDeploymentAs parameter with value 'new-workspace', triggering workspace deregistration from Rocket.Chat Cloud infrastructure. This results in immediate revocation of cloud-stored credentials, license invalidation, and disruption of push notification service that depends on cloud connectivity. The vulnerability affects all versions prior to: 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13.

Business impact

Organizations relying on Rocket.Chat Cloud services face service disruption without legitimate administrative action. A disgruntled employee, departing contractor, or compromised low-privilege account can instantly break push notifications for all users, revoke the workspace license, and force administrators into manual recovery workflows. This is not a denial-of-service that auto-recovers; it permanently severs cloud integration until manual re-registration occurs. License compliance and audit trails may be interrupted. For organizations using Rocket.Chat as a critical communication platform (especially those with external compliance requirements), this represents a significant operational and governance risk.

Affected systems

All Rocket.Chat installations prior to version 8.5.1 are affected. Specifically vulnerable versions include the entire 8.5.0 branch, 8.4.0–8.4.3, 8.3.0–8.3.5, 8.2.0–8.2.5, 8.1.0–8.1.5, 8.0.0–8.0.6, and 7.10.0–7.10.12. Self-hosted and cloud-hosted deployments are equally at risk. The vulnerability only manifests if the workspace is registered with Rocket.Chat Cloud (a common configuration for organizations seeking managed push notifications and cloud backups). Fully air-gapped or standalone deployments without cloud registration are not exploitable.

Exploitability

Exploitability is high. The attack requires only network access and a valid user credential (no elevated privileges needed). The CVSS vector reflects low attack complexity (AC:L) and network-based delivery (AV:N). An authenticated attacker needs only one HTTP POST call with a simple JSON payload—no multi-step exploitation, no race conditions, no user interaction required. The barrier to exploitation is exceptionally low: any employee with a standard Rocket.Chat login can weaponize this. The attack is deterministic and leaves minimal forensic artifacts beyond API logs. This is not listed in CISA's Known Exploited Vulnerabilities catalog as of the data timestamp, but the simplicity and severity warrant immediate patching.

Remediation

Upgrade to patched versions immediately: 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, or 7.10.13 (or later). Rocket.Chat has released patches across all active maintenance branches. If an immediate upgrade is not feasible, consider network-level controls: restrict access to the POST /api/v1/fingerprint endpoint to administrative IP ranges or disable it entirely until patching is complete. Monitor API access logs for POST requests to /api/v1/fingerprint with setDeploymentAs parameters from non-administrative accounts. Conduct a privilege review to identify and remove unnecessary user accounts or roles that should not have API access.

Patch guidance

Patches are available across all supported release tracks. For organizations on 8.5.x, update to 8.5.1. For 8.4.x, update to 8.4.4. For 8.3.x, update to 8.3.6. For 8.2.x, update to 8.2.6. For 8.1.x, update to 8.1.6. For 8.0.x, update to 8.0.7. For 7.10.x, update to 7.10.13. Rocket.Chat's official security advisory and release notes will contain detailed migration guidance. Test patches in a non-production environment first to validate compatibility with custom plugins, integrations, and user authentication backends. Schedule the upgrade during a maintenance window, as it may require a brief service restart.

Detection guidance

Review API access logs for POST requests to /api/v1/fingerprint endpoint in the 30 days prior to patching. Focus on requests originating from non-administrative user accounts (check the 'userId' or 'user' field in logs). Look for JSON payloads containing 'setDeploymentAs': 'new-workspace'. If Cloud deregistration occurred unexpectedly (sudden loss of cloud credentials, license warnings, or push notification failures), cross-reference the timestamp with API logs. Enable audit logging if not already active to track future /api/v1/fingerprint calls post-patch. Monitor for any attempts to re-execute the same API endpoint after patching—failed calls will indicate an attacker unaware of or testing for the patch.

Why prioritize this

This vulnerability scores CVSS 8.1 (HIGH) with immediate impact on confidentiality (cloud credentials exposed), integrity (workspace state altered), and availability (service disruption). The combination of trivial exploitability (unauthenticated-adjacent, single API call), catastrophic business impact (permanent loss of cloud integration), and low barrier to weaponization (any user account) elevates practical risk significantly. Organizations using Rocket.Chat Cloud features must prioritize this patch within their critical security windows. Even those with manual recovery procedures should treat this as urgent: the reputational and operational cost of an insider or compromised account deregistering the workspace is severe.

Risk score, explained

CVSS 8.1 is justified by: (1) Network-accessible endpoint (AV:N), (2) Low attack complexity—no special conditions or timing required (AC:L), (3) Low privilege requirements (PR:L)—authentication alone is sufficient; no admin role needed, (4) No user interaction (UI:N), (5) High integrity impact—workspace credentials and configuration permanently altered, (6) High availability impact—cloud services and push notifications disabled. The only mitigating factor is scope unchanged (S:U). The lack of confidentiality impact (C:N) prevents a critical score, but the combined destructive effect on system state and service availability places this firmly in high-severity territory. Organizations should treat this as a critical update due to its ease of exploitation and irreversible consequences.

Frequently asked questions