cveboard RSS feed

CVE-2026-45757

CVE.org · Published

Historical CVEsJSONAI instructions

Record status
Published
Identifier year (not publication year)
2026
Source publication
Source updated
Imported by cveboard
Source snapshot
cve_2026-10-24_midnight_baseline ·

Plain text

CNA source text (English)

Rocket.Chat: users.deactivateIdle` deactivates accounts without revoking existing login tokens

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12, Rocket.Chat allows users deactivated through users.deactivateIdle to keep using already-issued login tokens. A user that an administrator has marked inactive for idleness can still access authenticated REST endpoints with the old token. This vulnerability is fixed in 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

Rocket.Chat

Vendor
RocketChat
Product
Rocket.Chat
Platforms
Unknown
Default status
Unknown
Rocket.Chat · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
>= 8.5.0-rc.0, < 8.5.0affectedUnavailableUnavailableUnavailableNone listed
>= 8.4.0-rc.0, < 8.4.2affectedUnavailableUnavailableUnavailableNone listed
>= 8.3.0-rc.0, < 8.3.4affectedUnavailableUnavailableUnavailableNone listed
>= 8.2.0-rc.0, < 8.2.4affectedUnavailableUnavailableUnavailableNone listed
>= 8.1.0-rc.0, < 8.1.5affectedUnavailableUnavailableUnavailableNone listed
>= 8.0.0-rc.0, < 8.0.6affectedUnavailableUnavailableUnavailableNone listed
>= 7.11.0-rc.0, < 7.13.8affectedUnavailableUnavailableUnavailableNone listed
< 7.10.12affectedUnavailableUnavailableUnavailableNone listed