CVE-2026-23477

Rocket.Chat is an open-source, secure, fully customizable communications platform. In Rocket.Chat versions up to 6.12.0, the API endpoint GET /api/v1/oauth-apps.get is exposed to any authenticated user, regardless of their role or permissions. This endpoint returns an OAuth application, as long as the user knows its ID, including potentially sensitive fields such as client_id and client_secret. This vulnerability is fixed in 6.12.0.

CVSS v3 7.7 HIGH

7.7^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.1 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-g4wm-fg3c-g4p2	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:*

History

17 Jun 2026, 10:21

Type	Values Removed	Values Added
Summary		(es) Rocket.Chat es una plataforma de comunicaciones de código abierto, segura y totalmente personalizable. En las versiones de Rocket.Chat hasta la 6.12.0, el endpoint de la API GET /api/v1/oauth-apps.get está expuesto a cualquier usuario autenticado, independientemente de su rol o permisos. Este endpoint devuelve una aplicación OAuth, siempre que el usuario conozca su ID, incluyendo campos potencialmente sensibles como client_id y client_secret. Esta vulnerabilidad está corregida en la 6.12.0.

26 Jan 2026, 18:03

Type	Values Removed	Values Added
First Time		Rocket.chat Rocket.chat rocket.chat
CPE		cpe:2.3:a:rocket.chat:rocket.chat::::::::
References	~~() https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-g4wm-fg3c-g4p2 -~~	() https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-g4wm-fg3c-g4p2 - Exploit, Third Party Advisory

14 Jan 2026, 19:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-01-14 19:16

Updated : 2026-06-17 10:21

NVD link : CVE-2026-23477

Mitre link : CVE-2026-23477

CVE.ORG link : CVE-2026-23477

JSON object : View

Products Affected

rocket.chat

rocket.chat

CWE

CWE-269

Improper Privilege Management

CWE-862

Missing Authorization

{"id": "CVE-2026-23477", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23477", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-14T21:13:59.771321Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 3.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "RocketChat", "product": "Rocket.Chat", "versions": [{"status": "affected", "version": "< 6.12.0"}]}]}], "published": "2026-01-14T19:16:47.990", "references": [{"url": "https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-g4wm-fg3c-g4p2", "tags": ["Exploit", "Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-269"}, {"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Rocket.Chat is an open-source, secure, fully customizable communications platform. In Rocket.Chat versions up to 6.12.0, the API endpoint GET /api/v1/oauth-apps.get is exposed to any authenticated user, regardless of their role or permissions. This endpoint returns an OAuth application, as long as the user knows its ID, including potentially sensitive fields such as client_id and client_secret. This vulnerability is fixed in 6.12.0."}, {"lang": "es", "value": "Rocket.Chat es una plataforma de comunicaciones de c\u00f3digo abierto, segura y totalmente personalizable. En las versiones de Rocket.Chat hasta la 6.12.0, el endpoint de la API GET /api/v1/oauth-apps.get est\u00e1 expuesto a cualquier usuario autenticado, independientemente de su rol o permisos. Este endpoint devuelve una aplicaci\u00f3n OAuth, siempre que el usuario conozca su ID, incluyendo campos potencialmente sensibles como client_id y client_secret. Esta vulnerabilidad est\u00e1 corregida en la 6.12.0."}], "lastModified": "2026-06-17T10:21:39.460", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BDDC551C-B721-4452-91D8-D53E1316D806", "versionEndExcluding": "6.12.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}