CVE-2026-72918: Rocket.Chat WebSocket Lets Any Authenticated User Inject Fake Messages Into Other Users' Chats
Rocket.Chat's stream-notify-user WebSocket stream does not verify notification senders, so any authenticated user can inject ephemeral fake messages into another user's open chat. Fixed in 7.10.14 and 8.x releases.
Contents
TL;DR: Rocket.Chat's stream-notify-user WebSocket stream does not verify the sender of notification payloads. Any authenticated user can write arbitrary notification bodies that the client renders as ephemeral fake messages inside another user's open chat window. Fixed in versions 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1.
Who is affected
Rocket.Chat is an open-source communications platform with over 40,000 GitHub stars and millions of users worldwide. Organizations deploy it as a self-hosted alternative to Slack for team messaging, customer support, and secure internal communication. The platform supports voice, video, file sharing, and federation.
Every Rocket.Chat deployment before 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1 carries this vulnerability. Any authenticated user, regardless of role or permissions, can target any other user on the same instance. The attack surface is the entire user base of the server.
What happened
Rocket.Chat's real-time API uses Meteor's WebSocket-based DDP protocol. The stream-notify-user stream handles per-user notifications: message alerts, room changes, subscription updates. The stream accepts events including message, notification, rooms-changed, and subscriptions-changed.
The message event on stream-notify-user is designed for ephemeral messages, system alerts that appear in the chat UI without persisting to the database. The problem: the server did not check whether the WebSocket client sending a notification was authorized to impersonate the sender. Any authenticated user who subscribed to another user's notification stream could publish a message event with an arbitrary body. The recipient's client rendered it as a fake message inside their currently open chat.
Because the message is ephemeral, it does not show up in message history, search, or exports. The recipient sees it in real time and has no way to distinguish it from a legitimate system notification or chat message. This makes the bug well-suited for social engineering: inject a fake message that looks like it came from a colleague or administrator, instructing the target to click a link, share credentials, or approve an action.
What to do
Update to one of the fixed releases: 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, or 8.6.1. The fix enforces sender verification on the stream-notify-user stream so that a client can only publish notifications under its own identity.
If you cannot patch immediately, audit WebSocket connections for unusual subscription patterns. Restrict direct WebSocket access to trusted networks where possible. Educate users to verify unexpected in-chat messages through a secondary channel.
Why it matters
WebSocket-based real-time APIs are a common blind spot in application security audits. The ephemeral nature of the injected messages makes this bug particularly hard to detect after the fact. An attacker can deliver a convincing phishing payload directly inside a victim's chat interface, leveraging the trust users place in their communication platform. NVD enrichment is pending at time of writing.
References
Continue reading
All posts
CVE-2026-72603: wg-easy WireGuard UI Lets Low-Privilege Users Execute Root Commands
wg-easy 15.3.0 has an OS command injection vulnerability in its client creation flow. Users with clients.create permission can inject WireGuard PostUp directives via newlines in the client name field, achieving root code execution.
CVE-2026-72533: Portainer CE Authentication Bypass Grants Root Access to Docker Hosts
Portainer CE through 2.44.0 has an authentication bypass in its Docker proxy endpoint. Low-privileged users can craft non-canonical URL paths to bypass authorization checks and gain root-level access to the Docker host.
CVE-2026-58231: Unauthenticated RCE in SAP Commerce Cloud Data Hub Adapter
SAP Commerce Cloud Data Hub Adapter ships with a default authentication client. An unauthenticated attacker can submit crafted input to validation-lacking functions, achieving arbitrary code execution. No fix available yet.