CVE-2026-48929: rocket.chat before 7.10.13 (exclusive), from 7.13.0 (inclusive), before 7.13.9 (exclusive), from 8.0.0 (inclusive)…

Affected technology

rocket.chat · before 7.10.13 (exclusive)
rocket.chat

rocket.chat · from 7.13.0 (inclusive), before 7.13.9 (exclusive)
rocket.chat

rocket.chat · from 8.0.0 (inclusive), before 8.0.7 (exclusive)
rocket.chat

rocket.chat · from 8.1.0 (inclusive), before 8.1.6 (exclusive)
rocket.chat

rocket.chat · from 8.2.0 (inclusive), before 8.2.6 (exclusive)
rocket.chat

rocket.chat · from 8.3.0 (inclusive), before 8.3.6 (exclusive)
rocket.chat

rocket.chat · from 8.4.0 (inclusive), before 8.4.4 (exclusive)
rocket.chat

rocket.chat · from 8.5.0 (inclusive), before 8.5.1 (exclusive)
rocket.chat

Rocket.Chat · 0 to before 8.5.1, 0 to before 8.4.4, 0 to before 8.3.6, 0 to before 8.2.6, 0 to before 8.1.6, 0 to before 8.0.7, 0 to before 7.13.9, 0 to before 7.10.13
Rocket.Chat

Description’s affected range: versions <8.5.1, <8.4.4, <8.3.6, <8.2.6, <8.1.6, <8.0.7, <7.13.9, and <7.10.13

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Vendor/CNA’s CVSS 3.0 assessment (base score 7.5/10) rates confidentiality and integrity impact as none; availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.