Technical impact
Rocket.Chat exposes the Meteor method sendForgotPasswordEmail without a DDP rate limiter, allowing an unauthenticated caller to trigger password reset emails as often as desired. The method can be invoked over DDP or the HTTP route POST /api/v1/method.callAnon/sendForgotPasswordEmail, and it sends a reset message for any address that matches an account. Because no rate limiting is in place, an attacker can flood the deployment's mail sender with reset emails or probe for the existence of accounts, as the method returns true when the address matches an existing account or when no account exists, and returns false for accounts authenticated through external providers when password changes are disabled for OAuth users.
Affected Systems
All Rocket.Chat installations, particularly versions before the update that added the DDPRateLimiter rule. The vulnerability affects Rocket.Chat without the rate limit configured.
Risk and Exploitability
With a CVSS score of 6.9, the vulnerability presents a medium severity risk. The EPSS score is not available, and it is not listed in CISA’s KEV catalog. An attacker can exploit the lack of rate limiting by repeatedly calling the method from any IP address, leading to an unbounded volume of reset emails. The method’s unauthenticated nature and differences in return values enable large‑scale account enumeration.
