CVE-2026-32994
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
The /api/v1/autotranslate.translateMessage endpoint in versions <8.5.0, <8.4.2, <8.3.4, <8.2.4, <8.1.5, <8.0.6, <7.13.8, and <7.10.12 allows any authenticated user to retrieve the full content of any message from any room (private groups, direct messages, channels) by simply providing the target message ID. The endpoint fetches the message via Messages.findOneById(messageId) with no room access check (canAccessRoomIdAsync is never called), returning the complete IMessage object including message text, sender info, room ID, timestamps, and markdown content.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Rocket.Chat
- Vendor
- Rocket.Chat
- Product
- Rocket.Chat
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 0 | affected | semver | 8.5.0 | Unavailable | None listed |
| 0 | affected | semver | 8.4.2 | Unavailable | None listed |
| 0 | affected | semver | 8.3.4 | Unavailable | None listed |
| 0 | affected | semver | 8.2.4 | Unavailable | None listed |
| 0 | affected | semver | 8.1.5 | Unavailable | None listed |
| 0 | affected | semver | 8.0.6 | Unavailable | None listed |
| 0 | affected | semver | 7.13.8 | Unavailable | None listed |
| 0 | affected | semver | 7.10.12 | Unavailable | None listed |