CVE-2026-45689

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-45689
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45689.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-45689
Aliases
  • GHSA-8p25-fm45-pjrw
Published
2026-06-24T20:57:32.281Z
Modified
2026-07-15T01:48:52.141877119Z
Severity
  • 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
Rocket.Chat: Pre-Auth NoSQL Injection in OAuth2 Token Endpoint leading to Arbitrary User ATO
Details

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11, an unauthenticated network attacker obtains a valid Rocket.Chat OAuth access token for an arbitrary user by sending a single HTTP POST with MongoDB query operators to /oauth/token. The Rocket.Chat OAuth2 server does not validate that grant parameters are strings before forwarding them to findOne({...}) against the oauthapps and oauthaccesstokens collections, so an attacker substitutes {"$ne": null} for clientid, clientsecret, and refreshtoken and receives a freshly minted {accesstoken, refreshtoken} pair bound to whichever user's refresh token Mongo returned first. The resulting access token is a first-class bearer credential against the full /api/v1/* surface as that user. By iterating with $nin / $regex operators the attacker walks the entire oauthaccesstokens collection, collecting one fresh access token per user per request. If any matched token belongs to an admin, the stolen bearer gives full admin API access (including Apps-Engine app installation, i.e. server-side code execution). No account, credentials, userId, or prior interaction with the instance are required. This vulnerability is fixed in 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-943"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45689.json"
}
References

Affected packages

Git / github.com/rocketchat/rocket.chat

Affected ranges

Type
GIT
Repo
https://github.com/rocketchat/rocket.chat
Events
Introduced
f3c2b8356043884f29c4d802668f3366a471c957
Fixed
d0230e1ed86163b5cf9da57fda09fa86ea0b5c9f
Introduced
c54eea7bf4c643534b78b65041a2fc78e4f122e0
Fixed
a1b567bb36327c93bfaa8eba32c4bf94ecee2760
Introduced
d7325cd940dd6908069999e4d168dea938ee2f52
Fixed
84bb79f4aacf39dd3f909788e600c076368c3985
Introduced
d97ea5ff436e863332d7fd1fa086ef9a9d75cd52
Fixed
bb77a56b43c983bee6203ddb312a86c31f35e3e4
Introduced
c04b2ca3d4dc586dc504794fa3048bb0c723f5b2
Fixed
3c30743d812c50596694ea95bab5b84ebc7a5264
Introduced
84481796011e0a74658b3e37ac96dd246da9466b
Fixed
792cb12e4ebeb2566c593ecf5e6cc0d28a5d3f06
Introduced
de7ffad1fa219af50d6bc7ef06021db30fcbf183
Fixed
67947de0244ac3d35689efbf9c903dadf7f4ed14
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
85f0f2da5ff07643147d44697f16ce9685743520
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "8.5.0-rc.0"
        },
        {
            "fixed": "8.5.0"
        },
        {
            "introduced": "8.4.0-rc.0"
        },
        {
            "fixed": "8.4.1"
        },
        {
            "introduced": "8.3.0-rc.0"
        },
        {
            "fixed": "8.3.3"
        },
        {
            "introduced": "8.2.0-rc.0"
        },
        {
            "fixed": "8.2.3"
        },
        {
            "introduced": "8.1.0-rc.0"
        },
        {
            "fixed": "8.1.4"
        },
        {
            "introduced": "8.0.0-rc.0"
        },
        {
            "fixed": "8.0.5"
        },
        {
            "introduced": "7.11.0-rc.0"
        },
        {
            "fixed": "7.13.7"
        },
        {
            "introduced": "0"
        },
        {
            "fixed": "7.10.11"
        }
    ]
}

Affected versions

0.*
0.10.0
0.10.1
0.10.2
0.11.0
0.13.0
0.14.0
0.15.0
0.16.0
0.17.0
0.18.0
0.19.0
0.23.0
0.24.0
0.25.0
0.26.0
0.27.0
0.28.0
0.29.0
0.30.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.40.0
0.40.1
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.48.0
0.49.0
0.49.1
0.49.2
0.49.3
0.49.4
0.50.0
0.54.0
0.54.1
0.56.0
0.56.0-rc.0
0.56.0-rc.1
0.56.0-rc.2
0.56.0-rc.3
0.56.0-rc.4
0.56.0-rc.5
0.56.0-rc.6
0.56.0-rc.7
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.59.1
0.59.2
0.59.3
0.59.4
0.59.5
0.59.6
0.60.0
0.60.1
0.60.2
0.60.3
0.60.4
0.61.0
0.61.1
0.61.2
0.62.0
0.62.1
0.62.2
0.63.0
0.63.1
0.63.2
0.63.3
0.64.0
0.64.1
0.64.2
0.65.0
0.65.1
0.65.2
0.66.0
0.66.1
0.66.2
0.66.3
0.67.0
0.68.0
0.68.1
0.68.2
0.68.3
0.68.4
0.68.5
0.69.0
0.69.1
0.69.2
0.70.0
0.70.1
0.70.2
0.70.3
0.70.4
0.71.0
0.71.1
0.72.0
0.72.1
0.72.2
0.72.3
0.73.0
0.73.1
0.73.2
0.74.0
0.74.1
0.74.2
0.74.3
0.8.0
1.*
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.2.0
1.2.1
1.3.0
1.3.1
1.3.2
2.*
2.0.0
2.1.0
2.1.1
2.1.2
2.2.0
2.3.0
2.3.1
2.3.2
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.4.9
3.*
3.0.0
3.0.1
3.0.10
3.0.11
3.0.12
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.0.8
3.0.9
3.1.0
3.1.1
3.1.2
3.10.0
3.10.1
3.10.2
3.10.3
3.10.4
3.10.5
3.11.0
3.11.1
3.12.0
3.12.1
3.12.2
3.12.3
3.13.0
3.13.1
3.13.2
3.13.3
3.14.0
3.14.1
3.14.2
3.14.3
3.14.4
3.15.0
3.15.1
3.15.2
3.16.0
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.1
3.17.2
3.18.0
3.18.1
3.18.2
3.2.0
3.2.1
3.2.2
3.3.0
3.3.1
3.3.2
3.3.3
3.4.0
3.4.1
3.4.2
3.5.0
3.5.1
3.5.2
3.5.3
3.5.4
3.6.0
3.6.1
3.6.2
3.6.3
3.7.0
3.7.1
3.7.2
3.8.0
3.8.1
3.8.2
3.9.0
3.9.1
3.9.2
3.9.3
4.*
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.1.0
4.1.1
4.1.2
4.2.0
4.2.1
4.2.2
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0
4.4.1
4.4.2
4.4.4
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.6.0
4.6.1
4.6.2
4.6.3
4.7.0
4.7.1
4.7.2
4.7.3
4.8.0
4.8.2
5.*
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.1.0
5.1.1
5.1.3
5.1.4
5.2.0
5.3.0
5.3.1
5.3.2
5.3.4
5.3.5
5.4.0
5.4.1
5.4.2
5.4.3
5.4.4
6.*
6.0.0
7.*
7.10.0
7.10.1
7.10.10
7.10.2
7.10.3
7.10.4
7.10.5
7.10.6
7.10.7
7.10.8
7.10.9
7.11.0
7.12.0
7.12.1
7.12.2
7.13.0
7.13.1
7.13.2
7.13.3
7.13.4
7.13.5
7.13.6
7.8.0
7.8.0-rc.0
7.8.0-rc.1
7.8.1
7.8.2
7.8.3
7.9.0
7.9.1
7.9.3
8.*
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.1.0
8.1.1
8.1.2
8.1.3
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.4.1
8.4.2
8.4.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45689.json"