Rocket.Chat · Report #3589551
RBAC bypass on App log endpoints via `permissionRequired` typo — any authenticated user reads admin-only Enterprise App logs
Validstatus
mediumseverity
40upvotes
23 Apr 2026disclosed
Summary
A typo in the permissions mechanism for /api/apps/logs and /api/apps/:id/logs allows any authenticated user to retrieve information via GET requests.
Affects versions <8.4.0, <8.3.2, <8.2.2, <8.1.3, <8.0.4, <7.13.6, <7.12.7, <7.11.7, and <7.10.10.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.