The vulnerability allows an authenticated user with the create‑team permission to convert any unrelated public channel into a team by using the channelName parameter instead of the required channelId. Because the edit‑room permission is only checked against the channelId, the endpoint bypasses normal access controls. An attacker can therefore create new teams from arbitrary public channels, changing ownership and potentially exposing or isolating channel content without the knowledge of the original channel participants. The CWE-862 classification indicates a broken access control flaw.

Rocket.Chat instances running any version earlier than 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, or 8.6.1 are affected. Administrators should verify the version of the deployed Rocket.Chat platform and apply the fix as soon as possible.

The CVSS score of 4.3 reflects a moderate severity; the EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting limited exploitation evidence to date. Exploitation requires only an authenticated user with the create‑team privilege, which is often granted to non‑administrative roles. Once the endpoint is abused, the attacker can change the channel's privacy setting and membership, affecting confidentiality and availability of communications. The attack path involves logging into the platform, retrieving a public channel name, and calling the channels.convertToTeam REST endpoint with that name.