The vulnerability exists in the WebSocket stream used for user notifications. An authenticated user can craft arbitrary notification objects because the stream’s sender field is not validated. The client UI can then display a fabricated message in another user’s active chat window. This flaw allows a malicious user to inject messages that appear to come from others, potentially causing confusion, misinformation, or social engineering. The weakness is a classic Missing Authorization issue (CWE‑862).

The affected product is Rocket.Chat the open‑source communications platform. Versions before 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1 are vulnerable.

The CVSS score is 5.4, indicating moderate severity. No EPSS data is available and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires authentication and can be performed by any user with normal access. The risk is primarily to message integrity and potential privacy concerns through deception, rather than to system compromise or data exfiltration.