The /api/v1/autotranslate.translateMessage endpoint in Rocket.Chat allows any authenticated user to retrieve the complete content of any message in any room, including private groups, direct messages, and channels. The endpoint fetches a message by ID without performing a room access check, returning the full IMessage object with text, sender information, room ID, timestamps, and markdown. This flaw represents a classic improper access control vulnerability (CWE‑284) that can expose confidential communications to any logged‑in user.

All Rocket.Chat releases prior to 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12 are susceptible.

The vulnerability carries a CVSS score of 5.3, indicating moderate severity. Although the EPSS score is not available, the attack vector requires authentication, meaning only users who can log into the system can exploit it. The flaw is not listed in CISA’s KEV catalog, and no current public exploitation reports are known. Nevertheless, any compromised or legitimate user could harvest the content of private or sensitive messages, potentially violating confidentiality and privacy requirements.