CVE-2023-28357: Rocket.chat

Medium severity, CVSS 4.3. EPSS: 0.4% chance of exploitation in the next 30 days.

A vulnerability has been identified in Rocket.Chat, where the ACL checks in the Slash Command /mute occur after checking whether a user is a member of a given channel, leaking private channel members to unauthorized users. This allows authenticated users to enumerate whether a username is a member of a channel that they do not have access to.

Affected products

• Rocket.chat Rocket.chat: before 6.0.0 (fixed in 6.0.0)

Published 2023-05-11. Last modified 2026-06-17.