High · published January 14, 2026
⚡ If you know the right ID, you can access sensitive OAuth app details from Rocket.Chat! This vulnerability has a high severity score of 7.7, so let’s dive in! 🔍 Think of this like a guest at a party who finds a hidden file cabinet containing the contact information of every VIP in the room — access is granted just for knowing how to open it, without checking if they should even be looking! This means that any authenticated user could potentially expose sensitive information, including client IDs and secrets, which could lead to unauthorized access to third-party services. The risk is substantial because it opens the door for attackers to misuse these credentials for malicious activities, compromising the integrity of your communications platform. 🔓
Think of this like a guest at a party who finds a hidden file cabinet containing the contact information of every VIP in the room — access is granted just for knowing how to open it, without checking if they should even be looking! The vulnerability lies in the GET /api/v1/oauth-apps.get API endpoint, which is accessible to any authenticated user, bypassing role-based access controls. This flaw allows users to retrieve OAuth application details without appropriate permissions.
This means that any authenticated user could potentially expose sensitive information, including client IDs and secrets, which could lead to unauthorized access to third-party services. The risk is substantial because it opens the door for attackers to misuse these credentials for malicious activities, compromising the integrity of your communications platform. 🔓 To mitigate this issue, upgrade Rocket.Chat to version 6.12.1 or later immediately. Additionally, review user permissions and restrict access to sensitive API endpoints based on user roles to ensure that only authorized personnel can view OAuth details. You've got this! With these steps, you'll be on your way to securing your Rocket.Chat environment in no time! 🛡️