Rocket.Chat · Report #1406479
Moving private messages into vision with updateMessage method
Validstatus
highseverity
10upvotes
9 May 2023disclosed
Summary
A vulnerability has been discovered in the updateMessage Meteor Method, allowing adversaries to edit messages without proper authorization. This occurs due to insufficient permission checks for the "rid" parameter. Attackers can exploit this issue to leak private messages with known message IDs.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.