Rocket.Chat DDP methods getThreadsList and getThreadMessages accept raw, untyped parameters for room and thread identifiers, with no schema validation. An attacker can substitute a MongoDB operator object, such as {"$gt":"4"}, in place of a string room-id or message-id. Because the authorization check resolves to a room the attacker already has access to, the query then fans out across all rooms, exposing private thread parents and the content of all replies to a low‑privilege authenticated user.

The issue affects Rocket.Chat for the following versions: all releases prior to 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, and 7.10.15. Any deployment running one of these versions is at risk.

The vulnerability enables a low‑privilege authenticated user to read private thread data, compromising confidentiality across all private conversations. The attack can be performed by sending a crafted DDP payload; no special privileges are required beyond authentication. The lack of a public exploit listing and the absence of an EPSS score mean the exact likelihood is unknown, but the absence of a KEV designation suggests it has not yet been widely exploited. Nonetheless, the data disclosure risk warrants immediate remediation.