CVE-2026-32995: The Rocket

Synopsis

This is an authorization bypass (missing access control) in the Rocket.Chat DDP method autoTranslate.translateMessage. The vulnerability is reachable over the network by any authenticated user, with no elevated privileges required. A successful attacker reads the plaintext content of any message by ID across all room types, including private channels, direct messages, and end-to-end encrypted rooms. Patched-image rebuilds at versions 7.10.12, 7.13.8, 8.0.6, 8.1.5, and 8.2.4 are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The DDP endpoint is exposed over the network, so an attacker must be able to reach the Rocket.Chat service remotely.

• AuthenticationRequired

  Any low-privilege authenticated DDP account is sufficient; no administrative or special role is needed.

• Victim interactionNot required

  The attacker calls the DDP method directly and does not require any action from another user.

• Attack complexityDetail

  The exploit is reliable and condition-free: calling the unguarded DDP method with a known message ID consistently returns message content.

Blast Radius

• An attacker reads the full plaintext content of any message in any Rocket.Chat room by supplying only a message ID.
• Private channels and direct messages are equally exposed, bypassing any channel-level access restrictions.
• End-to-end encrypted (E2EE) room messages are accessible, undermining the confidentiality guarantee those rooms are intended to provide.
• No data is modified and no service disruption occurs; impact is limited to confidentiality of stored message content.