Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12, Rocket.Chat allows users deactivated through users.deactivateIdle to keep using already-issued login tokens. A user that an administrator has marked inactive for idleness can still access authenticated REST endpoints with the old token. This vulnerability is fixed in 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Rocketchat |
|
No data.
No data.
References
History
Thu, 25 Jun 2026 05:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Rocketchat
Rocketchat rocket.chat |
|
| Vendors & Products |
Rocketchat
Rocketchat rocket.chat |
Wed, 24 Jun 2026 21:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12, Rocket.Chat allows users deactivated through users.deactivateIdle to keep using already-issued login tokens. A user that an administrator has marked inactive for idleness can still access authenticated REST endpoints with the old token. This vulnerability is fixed in 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12. | |
| Title | Rocket.Chat: users.deactivateIdle` deactivates accounts without revoking existing login tokens | |
| Weaknesses | CWE-613 | |
| References |
| |
| Metrics |
cvssV4_0
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published: 2026-06-24T21:01:56.286Z
Updated: 2026-06-24T21:02:14.090Z
Reserved: 2026-05-13T06:54:34.221Z
Link: CVE-2026-45757
Vulnrichment
No data.
NVD
No data.
Redhat
No data.