What’s Vulnerable › Vulnerabilities
CVE-2026-23477: Rocket.Chat Unauthorized Access to OAuth App Details
- Severity: medium (CVSS 6.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2026-01-14 · updated 2026-06-17
- Weakness: CWE-269
Description
Rocket.Chat is an open-source, secure, fully customizable communications platform. In Rocket.Chat versions up to 6.12.0, the API endpoint GET /api/v1/oauth-apps.get is exposed to any authenticated user, regardless of their role or permissions. This endpoint returns an OAuth application, as long as the user knows its ID, including potentially sensitive fields such as client_id and client_secret. This vulnerability is fixed in 6.12.0.
Affected products
- Rocket.Chat: before 6.12.0 — fixed in 6.12.0
How to fix
Upgrade to a fixed version: Rocket.Chat 6.12.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-23477 or the next vulnerability affects your stack