CVE-2026-45757

published 2026-06-24

CVE-2026-45757: Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12…

Priority P4 17 low 2.3 CVSS 4.0

AV N AC H AT N PR N UI P VC L VI L VA N SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12, Rocket.Chat allows users deactivated through users.deactivateIdle to keep using already-issued login tokens. A user that an administrator has marked inactive for idleness can still access authenticated REST endpoints with the old token. This vulnerability is fixed in 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
rocketchat	rocket.chat	< 7.10.12	7.10.12
rocketchat	rocket.chat	—	—
rocketchat	rocket.chat	—	—
rocketchat	rocket.chat	—	—
rocketchat	rocket.chat	—	—
rocketchat	rocket.chat	—	—
rocketchat	rocket.chat	—	—
rocketchat	rocket.chat	—	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-613