CVE-2022-32211: Rocket.chat

High severity, CVSS 8.8. EPSS: 1.4% chance of exploitation in the next 30 days.

A SQL injection vulnerability exists in Rocket.Chat <v3.18.6, <v4.4.4 and <v4.7.3 which can allow an attacker to retrieve a reset password token through or a 2fa secret.

Affected products

• Rocket.chat Rocket.chat: before 3.18.6 (fixed in 3.18.6); from 4.0.0, before 4.4.4 (fixed in 4.4.4); from 4.7.0, before 4.7.3 (fixed in 4.7.3)

Published 2022-09-23. Last modified 2026-06-17.