CVE-2026-45689

Что произошло

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11, an unauthenticated network attacker obtains a valid Rocket.Chat OAuth access token for an arbitrary user by sending a single HTTP POST with MongoDB query operators to /oauth/token. The Rocket.Chat OAuth2 server does not validate that grant parameters are strings before forwarding them to findOne({...}) against the oauth_apps and oauth_access_tokens collections, so an attacker substitutes {"$ne": null} for client_id, client_secret, and refresh_token and receives a freshly minted {access_token, refresh_token} pair bound to whichever user's refresh token Mongo returned first. The resulting access token is a first-class bearer credential against the full /api/v1/* surface as that user. By iterating with $nin / $regex operators the attacker walks the entire oauth_access_tokens collection, collecting one fresh access token per user per request. If any matched token belongs to an admin, the stolen bearer gives full admin API access (including Apps-Engine app installation, i.e. server-side code execution). No account, credentials, userId, or prior interaction with the instance are required. This vulnerability is fixed in 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11.

Что делать

dpkg-query -W -f='${Package}	${Version}\n'

rpm -qa --qf '%{NAME}\t%{VERSION}-%{RELEASE}\n'

Get-HotFix | Select-Object HotFixID, InstalledOn

Продукты и затронутые версии

{
  "status": "affected",
  "version": ">= 8.5.0-rc.0, < 8.5.0"
}

{
  "status": "affected",
  "version": ">= 8.4.0-rc.0, < 8.4.1"
}

{
  "status": "affected",
  "version": ">= 8.3.0-rc.0, < 8.3.3"
}

{
  "status": "affected",
  "version": ">= 8.2.0-rc.0, < 8.2.3"
}

{
  "status": "affected",
  "version": ">= 8.1.0-rc.0, < 8.1.4"
}

{
  "status": "affected",
  "version": ">= 8.0.0-rc.0, < 8.0.5"
}

{
  "status": "affected",
  "version": ">= 7.11.0-rc.0, < 7.13.7"
}

{
  "status": "affected",
  "version": "< 7.10.11"
}

CVSS: оценки и векторы

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Источники и ссылки

{
  "cwes": [
    "cve"
  ],
  "epss": {
    "source": "epss",
    "received_at": "2026-11-03T21:13:40.915829+00:00"
  },
  "title": {
    "source": "cve",
    "received_at": "2026-11-03T22:27:46.706009+00:00"
  },
  "scores": [
    "cve"
  ],
  "status": {
    "source": "cve",
    "received_at": "2026-11-03T22:27:46.706009+00:00"
  },
  "affected": [
    "cve"
  ],
  "published": {
    "source": "cve",
    "received_at": "2026-11-03T22:27:46.706009+00:00"
  },
  "solutions": [],
  "percentile": {
    "source": "epss",
    "received_at": "2026-11-03T21:13:40.915829+00:00"
  },
  "references": [
    "cve"
  ],
  "description": {
    "source": "cve",
    "received_at": "2026-11-03T22:27:46.706009+00:00"
  },
  "workarounds": [],
  "configurations": []
}

Хронология записи

1. Данные обновлены04.11.2026, 00:13
2. Данные обновлены03.11.2026, 00:12
3. Данные обновлены02.11.2026, 00:11
4. Данные обновлены31.10.2026, 11:58
5. Данные обновлены29.10.2026, 12:28
6. Опубликована28.10.2026, 22:21

Личная заметка и статус

Другие CVE того же продукта