CVE-2026-48929

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-17 · updated 2026-10-24
Weakness: CWE-287

Description

Rocket.Chat in versions <8.5.1, <8.4.4, <8.3.6, <8.2.6, <8.1.6, <8.0.7, <7.13.9, and <7.10.13 is vulnerable to unauthenticated file deletion. The deleteFileMessage Meteor method permanently deletes any uploaded file by ID without requiring authentication. When called via an unauthenticated DDP WebSocket connection, Meteor.userId() returns null, causing the authorization check to be skipped. Execution falls through to FileUpload.getStore('Uploads').deleteById(fileID), which removes the file from storage and database unconditionally. File IDs are discoverable from public channel message payloads and download URLs.

Affected products

Rocket.Chat: before 7.10.13; from 7.13.0 before 7.13.9; from 8.0.0 before 8.0.7; from 8.1.0 before 8.1.6; from 8.2.0 before 8.2.6; from 8.3.0 before 8.3.6 — fixed in 7.10.13, 7.13.9, 8.0.7, 8.1.6, 8.2.6, 8.3.6

How to fix

Upgrade to a fixed version: Rocket.Chat 7.10.13, 7.13.9, 8.0.7, 8.1.6. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-48929 or the next vulnerability affects your stack