Auth bypass in Rocket.chat
CVE-2026-23477
Rocket.Chat is an open-source, secure, fully customizable communications platform. In Rocket.Chat versions up to 6.12.0, the API endpoint GET /api/v1/oauth-apps.get is exposed to any authenticated user, regardless of their role or permissions. This endpoint returns an OAuth application, as long as the user knows its ID, including potentially sensitive fields such as client_id and client_secret. This vulnerability is fixed in 6.12.0.
Vulnerability class: Privilege Escalation
EPSS: 0.003 (22.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.7 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N.
Affected products
- Rocket.chat
- Rocketchat Rocket.chat — versions < 6.12.0
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2026-23477?
- CVE-2026-23477 is a high-severity vulnerability in Rocket.chat, classified under Improper Privilege Management. CVSS score: 7.7/10. Published 2026-01-14.
- How severe is CVE-2026-23477?
- High severity. CVSS v3 base score is 7.7 out of 10.