CVE-2022-35249

A information disclosure vulnerability exists in Rocket.Chat <v5 where the getUserMentionsByChannel meteor server method discloses messages from private channels and direct messages regardless of the users access permission to the room.

Score

CVSS 3.1 4.3 Medium

Status

Modified - support@hackerone.com

Published

2022-09-23

Last modified

2025-05-22

Weaknesses

CWE-200, CWE-862

Affected products

• Rocket.chat (Rocket.chat)

References

• https://hackerone.com/reports/1410246