CVE-2026-72919: Rocket.Chat < 7.10.14, >= 8.0.0, < 8.0.8, >= 8.1.0, < 8.1.7, >= 8.2.0, < 8.2.7, >= 8.3.0, < 8.3.7, >= 8.4.0, < 8.4.5…

Affected technology

Rocket.Chat · < 7.10.14, >= 8.0.0, < 8.0.8, >= 8.1.0, < 8.1.7, >= 8.2.0, < 8.2.7, >= 8.3.0, < 8.3.7, >= 8.4.0, < 8.4.5, >= 8.5.0, < 8.5.2, >= 8.6.0, < 8.6.1
RocketChat

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

An authenticated registered user with the create-team permission can convert an unrelated public channel by supplying channelName instead of channelId because the edit-room permission is checked only for channelId. Vendor/CNA’s CVSS 3.1 assessment (base score 4.3/10) rates confidentiality and availability impact as none; integrity impact as low.