CVE-2026-32995

State: Published
Severity: 7.5 High
Published: May 28, 2026
Updated: May 28, 2026
Reserved: Mar 17, 2026

Description

The Rocket.Chat DDP method autoTranslate.translateMessage in versions <8.5.0, <8.4.2, <8.3.4, <8.2.4, <8.1.5, <8.0.5, <7.13.8, and <7.10.12 accepts a client-supplied IMessage object and passes it directly to translateMessage() without checking Meteor.userId() or verifying room membership. Any authenticated DDP user can read the content of any message by ID from any room (private channels, DMs, E2EE rooms) by calling this method.

Scores

CVSS	Score	Vector	Source
3.0	7.5 High	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	hackerone

Weaknesses

CWE-284 Improper Access Control - Generic

Affected Products

Product	Versions
Rocket.ChatRocket.Chat	8.5.0 to before 8.5.0Affected 8.4.0 to before 8.4.2Affected 8.3.0 to before 8.3.4Affected 8.2.0 to before 8.2.4Affected 8.1.0 to before 8.1.5Affected 8.0.0 to before 8.0.6Affected 7.13.0 to before 7.13.8Affected 7.10.0 to before 7.10.12Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.