Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12, Rocket.Chat does not revoke OAuth bearer or refresh tokens when a user is deactivated. A deactivated user can continue using an existing OAuth access token, and can also mint a fresh access token from an existing refresh token. This vulnerability is fixed in 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Rocketchat |
|
No data.
No data.
References
History
Thu, 25 Jun 2026 06:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Rocketchat
Rocketchat rocket.chat |
|
| Vendors & Products |
Rocketchat
Rocketchat rocket.chat |
Wed, 24 Jun 2026 21:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12, Rocket.Chat does not revoke OAuth bearer or refresh tokens when a user is deactivated. A deactivated user can continue using an existing OAuth access token, and can also mint a fresh access token from an existing refresh token. This vulnerability is fixed in 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12. | |
| Title | Rocket.Chat: OAuth access and refresh tokens remain valid after account deactivation | |
| Weaknesses | CWE-613 | |
| References |
| |
| Metrics |
cvssV4_0
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published: 2026-06-24T21:04:09.602Z
Updated: 2026-06-24T21:04:09.602Z
Reserved: 2026-05-28T20:07:58.861Z
Link: CVE-2026-49277
Vulnrichment
No data.
NVD
No data.
Redhat
No data.