Rocket.Chat is vulnerable to a NoSQL injection in the ddp-streamer microservice, allowing an unauthenticated attacker to manipulate MongoDB queries during authentication by injecting operator expressions into the username field. This flaw permits the attacker to make the database query match unintended user records, potentially granting access to other users’ data or bypassing authentication. The vulnerability carries a CVSS score of 6.9, indicating moderate severity with a range of possible confidentiality impacts.

The affected product is Rocket.Chat (RocketChat:Rocket.Chat) in all releases prior to versions 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1, and 8.2.0. Systems running any of those earlier releases are susceptible to this NoSQL injection in the ddp-streamer service.

The likelihood of exploitation is low, as indicated by an EPSS score of less than 1%, and the vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. However, because the flaw allows unauthenticated manipulation of authentication queries, attackers can potentially gain unauthorized access to user data. The moderate CVSS score reflects the potential confidentiality impact, while the minimal EPSS suggests that active exploitation is currently uncommon. Nonetheless, organizations should treat this as a moderate risk until the patch is applied.