Technical impact
The vulnerability is a typo in the permission check for the /api/apps/logs and /api/apps/:id/logs endpoints. Because the required permission is not correctly verified, any authenticated user can access application engine logs, even if they do not possess the appropriate privileges. This flaw allows an attacker who can authenticate to the system to read potentially sensitive administrative logs, exposing configuration data, user activity, or other internal information that should be protected. The weakness is categorized as Improper Access Control (CWE‑284).
Affected Systems
Rocket.Chat instances running any of the following versions are affected: all releases earlier than 8.4.0, 8.3.2, 8.2.2, 8.1.3, 8.0.4, 7.13.6, 7.12.7, 7.11.7, and 7.10.10. The issue applies to all environments where these versions are deployed.
Risk and Exploitability
The CVSS score of 4.3 indicates a moderate risk. The EPSS score is less than 1 %, implying a very low likelihood of exploitation under current conditions. The flaw is not listed in the CISA KEV catalog. Exploitation requires the attacker to be an authenticated user, so the attack vector is internal or through social engineering that grants legitimate credentials. The impact is limited to information disclosure rather than code execution or denial of service.
