Technical impact
Rocket.Chat DDP methods getThreadsList and getThreadMessages accept raw, untyped parameters for room and thread identifiers, with no schema validation. An attacker can substitute a MongoDB operator object, such as {"$gt":"4"}, in place of a string room-id or message-id. Because the authorization check resolves to a room the attacker already has access to, the query then fans out across all rooms, exposing private thread parents and the content of all replies to a low‑privilege authenticated user.
Affected Systems
The issue affects Rocket.Chat for the following versions: all releases prior to 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, and 7.10.15. Any deployment running one of these versions is at risk.
Risk and Exploitability
The vulnerability enables a low‑privilege authenticated user to read private thread data, compromising confidentiality across all private conversations. The attack can be performed by sending a crafted DDP payload; no special privileges beyond authentication are required. The EPSS score of <1% indicates a very low yet non‑zero probability of exploitation, and the absence of a KEV designation suggests it has not yet been widely exploited. Nonetheless, the data disclosure risk warrants immediate remediation. It scores a CVSS of 4.3, reflecting moderate severity.
