CVE-2026-49277: Rocketchat Rocket.chat

Low severity, CVSS 2.3. EPSS: 0.3% chance of exploitation in the next 30 days.

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12, Rocket.Chat does not revoke OAuth bearer or refresh tokens when a user is deactivated. A deactivated user can continue using an existing OAuth access token, and can also mint a fresh access token from an existing refresh token. This vulnerability is fixed in 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12.

Affected products

• Rocketchat Rocket.chat: from 8.5.0-rc.0, before 8.5.0 (fixed in 8.5.0); from 8.4.0-rc.0, before 8.4.2 (fixed in 8.4.2); from 8.3.0-rc.0, before 8.3.4 (fixed in 8.3.4); from 8.2.0-rc.0, before 8.2.4 (fixed in 8.2.4); from 8.1.0-rc.0, before 8.1.5 (fixed in 8.1.5); from 8.0.0-rc.0, before 8.0.6 (fixed in 8.0.6); …

Published 2026-06-24. Last modified 2026-06-26.