CVE-2026-29197: rocket.chat from 7.10.0 (inclusive), before 7.10.10 (exclusive), from 7.11.0 (inclusive), before 7.11.7 (exclusive)…

Affected technology

rocket.chat · from 7.10.0 (inclusive), before 7.10.10 (exclusive)
rocket.chat

rocket.chat · from 7.11.0 (inclusive), before 7.11.7 (exclusive)
rocket.chat

rocket.chat · from 7.12.0 (inclusive), before 7.12.7 (exclusive)
rocket.chat

rocket.chat · from 7.13.0 (inclusive), before 7.13.6 (exclusive)
rocket.chat

rocket.chat · from 8.0.0 (inclusive), before 8.0.4 (exclusive)
rocket.chat

rocket.chat · from 8.1.0 (inclusive), before 8.1.3 (exclusive)
rocket.chat

rocket.chat · from 8.2.0 (inclusive), before 8.2.2 (exclusive)
rocket.chat

rocket.chat · from 8.3.0 (inclusive), before 8.3.2 (exclusive)
rocket.chat

Rocket.Chat · 8.4.0 to before 8.4.0, 8.3.2 to before 8.3.2, 8.2.2 to before 8.2.2, 8.1.3 to before 8.1.3, 8.0.4 to before 8.0.4, 7.13.6 to before 7.13.6, 7.12.7 to before 7.12.7, 7.11.7 to before 7.11.7, 7.10.10 to before 7.10.10
Rocket.Chat

Description’s affected range: versions <8.4.0

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Source advisory’s CVSS 3.1 assessment (base score 4.3/10) rates confidentiality impact as low; integrity and availability impact as none. The description does not specify what an attacker can achieve beyond these rated impacts.