Auth bypass in Rocket.chat Desktop
CVE-2024-8270
The macOS Rocket.Chat application is affected by a vulnerability that allows bypassing Transparency, Consent, and Control (TCC) policies, enabling the exploitation or abuse of permissions specified in its entitlements (e.g., microphone, camera, automation, network client). Since Rocket.Chat was not signed with the Hardened Runtime nor set to enforce Library Validation, it is vulnerable to DYLIB injection attacks, which can lead to unauthorized actions or escalation of permissions. Consequently, an attacker gains capabilities that are not permitted by default under the Sandbox and its application profile.
Vulnerability class: Broken Access Control
EPSS: 0.002 (8.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Rocket.chat Desktop — versions 0
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2024-8270?
- CVE-2024-8270 is a medium-severity vulnerability in Rocket.chat Desktop, classified under Incorrect Authorization. CVSS score: 5.5/10. Published 2025-06-11.
- How severe is CVE-2024-8270?
- Medium severity. CVSS v3 base score is 5.5 out of 10.