CVE-2026-48616: Rocket

Synopsis

This is a broken access control vulnerability in Rocket.Chat's Livechat file-download endpoint. The endpoint at /file-upload/:fileId/:name accepts a livechat session token (rc_rid plus rc_token) to authorize downloads, but never checks whether rc_rid actually belongs to the file being requested. Because MongoDB object IDs are sequential and predictable, and the :name segment accepts any value, an unauthenticated attacker can enumerate and download any file uploaded to the chat server without holding a valid session for that file. Patched-image rebuilds at versions 7.10.13, 7.13.9, 8.0.7, 8.1.6, and 8.2.6 are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network; an attacker must be able to send HTTP requests to the Rocket.Chat server to exploit this vulnerability.

• AuthenticationNot required

  No account or session credentials are required; the attacker supplies an arbitrary livechat token that the server never validates against the requested file.

• Victim interactionNot required

  The attacker interacts directly with the server endpoint; no user action or social engineering is needed.

• Attack complexityDetail

  The exploit is reliable and condition-free; MongoDB object IDs are sequential, making file enumeration straightforward with no race conditions or special environmental setup required.

Blast Radius

• Reads any file uploaded by any user or livechat visitor on the server, including documents, images, and attachments shared in private conversations.
• Enumerates the full corpus of uploaded files by iterating predictable sequential file IDs, with no prior knowledge of room membership or file names.
• Exposes potentially sensitive business documents, identity verification files, or customer support attachments that were assumed to be access-controlled.