CVE-2026-45757CWE-613

Rocket.Chat: users.deactivateIdle` deactivates accounts without revoking existing login tokens

Low · published June 24, 2026

CVSS v4.0
2.3
EPSS
0%
Percentile
23.0
In the wild
Unconfirmed
What it is

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12, Rocket.Chat allows users deactivated through users.deactivateIdle to keep using already-issued login tokens. A user that an administrator has marked inactive for idleness can still access authenticated REST endpoints with the old token. This vulnerability is fixed in 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12.

The record
Technical detail
CVSS v4.0
2.3 · LOW
Vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00314 · 23.0th percentile
Weakness
CWE-613 · Insufficient Session Expiration
Published
2026-06-24T21:01Z
EPSS history
Timeline
  • 24 JUN 21:01Z
    Rocket.Chat: users.deactivateIdle` deactivates accounts without revoking existing login tokens
    cvelistv5