RocketChat
Rocket.Chat
Open-source team chat and collaboration platform.
8.2.7
- Release date
- July 10, 2026
- Security status
- Current version appears affected by 3 high-severity CVEs.
Source
GitHub API
Public release notes are linked for the latest stored release.
Release history
See the latest published releases stored for this product.
| Version | Published | Notes |
|---|---|---|
| 8.2.7 | 2026-07-10 | Release Notes |
| 8.2.6 | 2026-06-15 | Release Notes |
| 8.2.5 | 2026-06-02 | Release Notes |
| 8.2.4 | 2026-05-22 | Release Notes |
| 8.2.3 | 2026-05-08 | Release Notes |
| 8.2.2 | 2026-04-13 | Release Notes |
| 8.2.1 | 2026-03-16 | Release Notes |
| 8.2.0 | 2026-03-02 | Release Notes |
Vulnerability tracking
versionPing monitors CVEs for this product. Matching CVEs are listed below. We only display CVEs with a CVSS score of 7.0 or higher that were published within the last 90 days.
Affected status is inferred from published affected version ranges where available. Always verify against the vendor advisory before making production decisions.
| CVE | Severity | Published | Status | Summary |
|---|---|---|---|---|
| CVE-2026-48929 | HIGH (7.5) | 2026-06-17 | Current versionaffected | Rocket.Chat in versions <8.5.1, <8.4.4, <8.3.6, <8.2.6, <8.1.6, <8.0.7, <7.13.9, and <7.10.13 is vulnerable to unauthenticated file deletion. The deleteFileMessage Meteor method permanently deletes any uploaded file by ID without requiring authentication. When called via an unauthenticated DDP WebSocket connection, Meteor.userId() returns null, causing the authorization check to be skipped. Execution falls through to FileUpload.getStore('Uploads').deleteById(fileID), which removes the file from storage and database unconditionally. File IDs are discoverable from public channel message payloads and download URLs. Affected versions
Show 6 more
|
| CVE-2026-48616 | CRITICAL (9.3) | 2026-06-17 | Current versionaffected | Rocket.Chat versions <8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, 7.13.9, 7.10.13 has an access control vulnerability in Livechat files. Protected file downloads at /file-upload/:fileId/:name authorize livechat access using rc_room_type=l with rc_rid+rc_token, but the authorization path does not verify that rc_rid matches the requested file's rid. Furthermore, :fileId is predictable via sequential MongoDB IDs, and :name can be anything, allowing unauthenticated discovery of all uploaded files. Affected versions
Show 6 more
|
| CVE-2026-32995 | HIGH (7.5) | 2026-05-28 | Current versionnot affected | The Rocket.Chat DDP method autoTranslate.translateMessage in versions <8.5.0, <8.4.2, <8.3.4, <8.2.4, <8.1.5, <8.0.5, <7.13.8, and <7.10.12 accepts a client-supplied IMessage object and passes it directly to translateMessage() without checking Meteor.userId() or verifying room membership. Any authenticated DDP user can read the content of any message by ID from any room (private channels, DMs, E2EE rooms) by calling this method. Affected versions
Show 6 more
|
| CVE-2026-29198 | CRITICAL (9.8) | 2026-04-23 | Current versionaffected | In Rocket.Chat <8.3.0, <8.2.1, <8.1.2, <8.0.3, <7.13.5, <7.12.6, <7.11.6, and <7.10.9, a NoSQL injection vulnerability can lead to account takeover of the first user with a generated token when an OAuth app is configured. Affected versions
Show 5 more
|