CVE-2026-32995: Rocket.Chat 8.5.0 to before 8.5.0, 8.4.0 to before 8.4.2, 8.3.0 to before 8.3.4, 8.2.0 to before 8.2.4, 8.1.0 to…

Affected technology

Rocket.Chat · 8.5.0 to before 8.5.0, 8.4.0 to before 8.4.2, 8.3.0 to before 8.3.4, 8.2.0 to before 8.2.4, 8.1.0 to before 8.1.5, 8.0.0 to before 8.0.6, 7.13.0 to before 7.13.8, 7.10.0 to before 7.10.12
Rocket.Chat

Description’s affected range: versions <8.5.0

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Any authenticated DDP user can read the content of any message by ID from any room (private channels, DMs, E2EE rooms) by calling this method. Vendor/CNA’s CVSS 3.0 assessment (base score 7.5/10) rates confidentiality impact as high; integrity and availability impact as none.