VulnSocial

CVE-2026-30833Disclosure(rocket.chat / rocket.chat)

LOWCVSS 5.3 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to versions 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1, and 8.2.0, a NoSQL injection vulnerability exists in Rocket.Chat's account service used in the ddp-streamer micro service that allows unauthenticated attackers to manipulate MongoDB queries during authentication. The vulnerability is located in the username-based login flow where user-supplied input is directly embedded into a MongoDB query selector without validation. An attacker can inject MongoDB operator expressions (e.g., { $regex: '.*' }) in place of a username string, causing the database query to match unintended user records. This issue has been patched in versions 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1, and 8.2.0.

rocket.chat CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-943

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • rocket.chat

Threat summary

  • 2 mentions across 1 observed day

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • General: 1 classified signal
  • 2 total mentions across 1 day

Affected systems

Vendors
rocket.chat
Products
rocket.chat

1 version affected across 1 product

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-03-06: 2Technical Details · 2026-03-06: 203-06
Signal classification2 categories
Disclosure
150.0%
General
150.0%
Referenced assets3 URLs
Full discourse2 posts
  • CVE@CVEnew
    Disclosure

    CVE-2026-30833 http://Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to versions 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1, and 8.2.0, a NoSQL … https://www.cve.org/CVERecord?id=CVE-2026-30833

    Post summary

    CVE-2026-30833 is a NoSQL injection flaw in older Rocket.Chat releases; the <a href="https://www.cve.org/CVERecord?id=CVE-2026-30833">CVE record</a> documents the affected versions, but no PoC, exploit, or patch details are provided.

    0000095
    56.6K followersView on X
  • CyberDudeBivash® | Global Cybersecurity Company@cyberbivash
    General

    🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-30833 - http://Rocket.Chat: NoSQL injection in the EE ddp-streamer-service Intel Report: https://ift.tt/QKM9yYR

    Post summary

    The alert references CVE-2026-30833, noting a NoSQL injection flaw in Rocket.Chat’s ddp-streamer-service, but it offers no proof of concept, exploit details, or remediation information.

    0000022
    343 followersView on X
CPE platform detail4 entries

4 of 4 entries

PartVendorProductVersionTarget SWTarget HW
Approcket.chatrocket.chat---
Approcket.chatrocket.chat8.2.0--
Approcket.chatrocket.chat8.2.0--
Approcket.chatrocket.chat8.2.0--

Explore more

Back to dashboardrocket.chat CVEsrocket.chat vulnerabilities