Moving private messages into vision with updateMessage method
High
R
Rocket.Chat
Submitted None
Team Summary
Official summary from Rocket.Chat
A vulnerability has been discovered in the updateMessage Meteor Method, allowing adversaries to edit messages without proper authorization. This occurs due to insufficient permission checks for the "rid" parameter. Attackers can exploit this issue to leak private messages with known message IDs.
Actions:
Reported by
gronke
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Submitted
Weakness
Information Disclosure