CVE-2026-48616: rocket.chat before 7.10.13 (exclusive), from 7.13.0 (inclusive), before 7.13.9 (exclusive), from 8.0.0 (inclusive)…

Affected technology

rocket.chat · before 7.10.13 (exclusive)
rocket.chat

rocket.chat · from 7.13.0 (inclusive), before 7.13.9 (exclusive)
rocket.chat

rocket.chat · from 8.0.0 (inclusive), before 8.0.7 (exclusive)
rocket.chat

rocket.chat · from 8.1.0 (inclusive), before 8.1.6 (exclusive)
rocket.chat

rocket.chat · from 8.2.0 (inclusive), before 8.2.6 (exclusive)
rocket.chat

rocket.chat · from 8.3.0 (inclusive), before 8.3.6 (exclusive)
rocket.chat

rocket.chat · from 8.4.0 (inclusive), before 8.4.4 (exclusive)
rocket.chat

rocket.chat · from 8.5.0 (inclusive), before 8.5.1 (exclusive)
rocket.chat

Rocket.Chat · 0 to before 8.5.1, 0 to before 8.4.4, 0 to before 8.3.6, 0 to before 8.2.6, 0 to before 8.1.6, 0 to before 8.0.7, 0 to before 7.13.9, 0 to before 7.10.13
Rocket.Chat

Description’s affected range: versions <8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, 7.13.9, 7.10.13

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Vendor/CNA’s CVSS 3.0 assessment (base score 9.3/10) rates confidentiality impact as high; integrity impact as low; availability impact as none. The description does not specify what an attacker can achieve beyond these rated impacts.