CVE-2026-48929: Rocket

Synopsis

An unauthenticated file deletion vulnerability exists in Rocket.Chat across several version branches below the patched releases. Any unauthenticated attacker reachable over the network can invoke the deleteFileMessage Meteor method via a WebSocket connection without logging in, causing a flawed null-user authorization check to be silently skipped. Successful exploitation permanently deletes any uploaded file from storage and the database by its ID, which is discoverable from public channel messages and download URLs. Patched-image rebuilds at versions 7.10.13, 7.13.9, 8.0.7, 8.1.6, and 8.2.6 are available on HarborGuard for environments running affected versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Rocket.Chat WebSocket endpoint over the network; no prior access to the host is needed.

• AuthenticationNot required

  No account or credentials are needed; the vulnerability is reachable via an unauthenticated DDP WebSocket connection.

• Victim interactionNot required

  No user action or social engineering is required; the attacker sends the malicious method call directly.

• Attack complexityDetail

  The exploit is reliable and condition-free; file IDs are discoverable from public channel message payloads and download URLs, requiring no special timing or environmental setup.

Blast Radius

• Permanently deletes any uploaded file from Rocket.Chat storage and the database by ID, with no recovery path once the deletion executes.
• Destroys message attachments, shared documents, and media files across all channels whose IDs are visible in public message payloads or download URLs.
• Enables systematic destruction of file content at scale, since file IDs are enumerable from public channel history without authentication.
• Does not expose or modify confidential data or account credentials, but eliminates file availability entirely for affected records.