CVE-2022-35249 - A information disclosure vulnerability exists in Rocket.Chat <v5 where the getUserMentionsByChannel meteor server method discloses messages from private channels and direct messages regardless of the users access permission to the room

Back Back to CVE browser

MEDIUM

A information disclosure vulnerability exists in Rocket.Chat <v5 where the getUserMentionsByChannel meteor server method discloses messages from private channels and direct messages regardless of the users access permission to the room

Published Sep 23, 2022

4.3

MEDIUM

CVSS 3.1

EPSS 0.75%

Description

A information disclosure vulnerability exists in Rocket.Chat <v5 where the getUserMentionsByChannel meteor server method discloses messages from private channels and direct messages regardless of the users access permission to the room.

Affected products

Vendor n/a Product Rocket.Chat Default
n/a
- Version
  Fixed in version 5.0>
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Rocket.Chat

n/a

Version	Status	Constraints
Fixed in version 5.0>	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-200

Exposure of Sensitive Information

CWE-862

Missing Authorization

References (1)

https://hackerone.com/reports/1410246
x_refsource_MISCExploitIssue TrackingThird Party Advisory

Link	Providers	Tags
https://hackerone.com/reports/1410246		x_refsource_MISCExploitIssue TrackingThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner hackerone

Published Sep 23, 2022

Updated May 22, 2025

Reserved Jul 6, 2022

Link CVE-2022-35249

CISA Vulnrichment

Updated May 22, 2025

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2022-35249

Red Hat

Severity n/a

Public date n/a

Links CVE-2022-35249