CVE-2023-28325

MEDIUM

Rocket.Chat < 6.0.0 - Improper Authorization via rid Parameter Manipulation

Title source: llm

Description

An improper authorization vulnerability exists in Rocket.Chat <6.0 that could allow a hacker to manipulate the rid parameter and change the updateMessage method that only checks whether the user is allowed to edit message in the target room.

References (1)

Core 1

Core References

Issue Tracking, Third Party Advisory

https://hackerone.com/reports/1406479

Scores

CVSS v3 6.5

EPSS 0.0039

EPSS Percentile 31.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-285 CWE-287 CWE-863

Status published

Products (1)

rocket.chat/rocket.chat < 6.0.0

Published May 11, 2023

Tracked Since Feb 18, 2026