CVE-2026-32994

Severity: medium (CVSS 5.3 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-19 · updated 2026-10-23
Weakness: CWE-284

Description

The /api/v1/autotranslate.translateMessage endpoint in versions <8.5.0, <8.4.2, <8.3.4, <8.2.4, <8.1.5, <8.0.6, <7.13.8, and <7.10.12 allows any authenticated user to retrieve the full content of any message from any room (private groups, direct messages, channels) by simply providing the target message ID. The endpoint fetches the message via Messages.findOneById(messageId) with no room access check (canAccessRoomIdAsync is never called), returning the complete IMessage object including message text, sender info, room ID, timestamps, and markdown content.

Affected products

Rocket.Chat: before 8.5.0; before 8.4.2; before 8.3.4; before 8.2.4; before 8.1.5; before 8.0.6 — fixed in 7.10.12, 7.13.8, 8.0.6, 8.1.5, 8.2.4, 8.3.4

How to fix

Upgrade to a fixed version: Rocket.Chat 7.10.12, 7.13.8, 8.0.6, 8.1.5. Check the vendor advisory for mitigations.

References

https://hackerone.com/reports/3713682

Get alerted when CVE-2026-32994 or the next vulnerability affects your stack