CVE-2026-75575

{"id": "CVE-2026-75575", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-75575", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-25T15:25:37.838804Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/RocketChat/Rocket.Chat", "vendor": "RocketChat", "product": "Rocket.Chat", "versions": [{"status": "affected", "version": "0", "lessThan": "7.10.15", "versionType": "semver"}, {"status": "affected", "version": "8.0.0", "lessThan": "8.1.8", "versionType": "semver"}, {"status": "affected", "version": "8.2.0", "lessThan": "8.2.8", "versionType": "semver"}, {"status": "affected", "version": "8.3.0", "lessThan": "8.3.8", "versionType": "semver"}, {"status": "affected", "version": "8.4.0", "lessThan": "8.4.6", "versionType": "semver"}, {"status": "affected", "version": "8.5.0", "lessThan": "8.5.3", "versionType": "semver"}, {"status": "affected", "version": "8.6.0", "lessThan": "8.6.2", "versionType": "semver"}, {"status": "affected", "version": "8.7.0", "lessThan": "8.7.2", "versionType": "semver"}, {"status": "affected", "version": "8.8.0-rc.0", "lessThan": "8.8.0", "versionType": "semver"}], "packageURL": "pkg:github/RocketChat/Rocket.Chat", "defaultStatus": "unaffected"}]}], "published": "2026-08-25T02:16:51.457", "references": [{"url": "https://github.com/RocketChat/Rocket.Chat", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/RocketChat/Rocket.Chat/commit/3a61c3afe", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-7c6v-m68v-v73r", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/rocket-chat-missing-ddp-rate-limit-on-the-sendforgotpasswordemail-meteor-method", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-204"}, {"lang": "en", "value": "CWE-307"}]}], "descriptions": [{"lang": "en", "value": "Rocket.Chat exposes the sendForgotPasswordEmail Meteor method without a DDP rate limit, so an unauthenticated caller may invoke it as often as it likes. The method is reachable over DDP and over the HTTP route POST /api/v1/method.callAnon/sendForgotPasswordEmail, and it triggers a password reset message for any address that matches an account. With no DDPRateLimiter rule registered for it, a caller can drive an unbounded volume of reset mail at a chosen address from the deployment's own mail sender, and can probe addresses at scale: the method answers true for an address with no account and for a successful send, but false when the address belongs to an account that authenticates through an external provider and Accounts_AllowPasswordChangeForOAuthUsers is off, so repeated calls distinguish that class of account. Later versions register a rule permitting ten calls per minute per client address."}, {"lang": "es", "value": "Rocket.Chat expone el m\u00e9todo Meteor sendForgotPasswordEmail sin un l\u00edmite de tasa DDP, por lo que un llamador no autenticado puede invocarlo tan a menudo como desee. El m\u00e9todo es accesible a trav\u00e9s de DDP y a trav\u00e9s de la ruta HTTP POST /api/v1/method.callAnon/sendForgotPasswordEmail, y desencadena un mensaje de restablecimiento de contrase\u00f1a para cualquier direcci\u00f3n que coincida con una cuenta. Al no tener una regla DDPRateLimiter registrada para \u00e9l, un llamador puede generar un volumen ilimitado de correos de restablecimiento a una direcci\u00f3n elegida desde el propio remitente de correo del despliegue, y puede sondear direcciones a escala: el m\u00e9todo responde true para una direcci\u00f3n sin cuenta y para un env\u00edo exitoso, pero false cuando la direcci\u00f3n pertenece a una cuenta que se autentica a trav\u00e9s de un proveedor externo y Accounts_AllowPasswordChangeForOAuthUsers est\u00e1 desactivado, por lo que las llamadas repetidas distinguen esa clase de cuenta. Versiones posteriores registran una regla que permite diez llamadas por minuto por direcci\u00f3n de cliente."}], "lastModified": "2026-10-12T15:10:00.207", "sourceIdentifier": "disclosure@vulncheck.com"}