CVE-2026-45757: Rocket.Chat: users.deactivateIdle` deactivates accounts without revoking existing login tokens

Severity: low (CVSS 2.3 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-24 · updated 2026-10-25
Weakness: CWE-613

Description

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12, Rocket.Chat allows users deactivated through users.deactivateIdle to keep using already-issued login tokens. A user that an administrator has marked inactive for idleness can still access authenticated REST endpoints with the old token. This vulnerability is fixed in 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12.

Affected products

Rocket.Chat: from 8.5.0-rc.0, < 8.5.0; from 8.4.0-rc.0, < 8.4.2; from 8.3.0-rc.0, < 8.3.4; from 8.2.0-rc.0, < 8.2.4; from 8.1.0-rc.0, < 8.1.5; from 8.0.0-rc.0, < 8.0.6

References

Get alerted when CVE-2026-45757 or the next vulnerability affects your stack