CVE catalog
CVE-2026-48929
Rocket.Chat in versions <8.5.1, <8.4.4, <8.3.6, <8.2.6, <8.1.6, <8.0.7, <7.13.9, and <7.10.13 is vulnerable to unauthenticated file deletion. The deleteFileMessage Meteor method permanently deletes an
- Severity
- High · CVSS 7.5
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.72% · Oct 25, 2026
Rocket.Chat in versions <8.5.1, <8.4.4, <8.3.6, <8.2.6, <8.1.6, <8.0.7, <7.13.9, and <7.10.13 is vulnerable to unauthenticated file deletion. The deleteFileMessage Meteor method permanently deletes any uploaded file by ID without requiring authentication. When called via an unauthenticated DDP WebSocket connection, Meteor.userId() returns null, causing the authorization check to be skipped. Execution falls through to FileUpload.getStore('Uploads').deleteById(fileID), which removes the file from storage and database unconditionally. File IDs are discoverable from public channel message payloads and download URLs.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Cpe | rocket.chat | Not reported | 7.10.13 | fixed |
| Cpe | rocket.chat | Not reported | 7.13.9 | fixed |
| Cpe | rocket.chat | Not reported | 8.0.7 | fixed |
| Cpe | rocket.chat | Not reported | 8.1.6 | fixed |
| Cpe | rocket.chat | Not reported | 8.2.6 | fixed |
| Cpe | rocket.chat | Not reported | 8.3.6 | fixed |
| Cpe | rocket.chat | Not reported | 8.4.4 | fixed |
| Cpe | rocket.chat | Not reported | 8.5.1 | fixed |
| Cpe | rocket.chat | Not reported | 8.5.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Cpe | rocket.chat | cpe | Not reported | 7.10.13 | Not reported | Not reported | Not reported |
| Cpe | rocket.chat | cpe | Not reported | 7.13.9 | Not reported | Not reported | Not reported |
| Cpe | rocket.chat | cpe | Not reported | 8.0.7 | Not reported | Not reported | Not reported |
| Cpe | rocket.chat | cpe | Not reported | 8.1.6 | Not reported | Not reported | Not reported |
| Cpe | rocket.chat | cpe | Not reported | 8.2.6 | Not reported | Not reported | Not reported |
| Cpe | rocket.chat | cpe | Not reported | 8.3.6 | Not reported | Not reported | Not reported |
| Cpe | rocket.chat | cpe | Not reported | 8.4.4 | Not reported | Not reported | Not reported |
| Cpe | rocket.chat | cpe | Not reported | 8.5.1 | Not reported | Not reported | Not reported |
| Cpe | rocket.chat | cpe | Not reported | 8.5.1 | Not reported | NVD-CVE-2026-48929 | Not reported |
OpenFactory catalog packages
No matching packages in this catalog.
Observed: