Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-65644

Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, and 7.10.15 has a REST API endpoint POST /api/v1/livechat/visitor that accepts an unauthentic

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
hackerone

Description

Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, and 7.10.15 has a REST API endpoint POST /api/v1/livechat/visitor that accepts an unauthenticated, unsanitized name field for Livechat visitors. This name is stored raw and later rendered via dangerouslySetInnerHTML in the Omnichannel Queue side panel (InquireSidePanelItem.tsx), injecting a real, clickable HTML link - pointing to any attacker-controlled domain, with arbitrary social-engineering text - into the DOM of any agent viewing the queue.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Rocket.Chat Rocket.Chat

Default version status: unaffected

  • 0 to < 8.8.0affected
  • 0 to < 8.7.1affected
  • 0 to < 8.6.2affected
  • 0 to < 8.5.3affected
  • 0 to < 8.4.6affected
  • 0 to < 8.3.8affected
  • 0 to < 8.2.8affected
  • 0 to < 8.1.8affected
  • 0 to < 7.10.15affected

References