Rocket.Chat

v8.2.6 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 1mo Communication & Email

✓ No known CVEs patched

This release patches 2 known CVEs

Topics

chat collaboration free javascript meteor mit

+3 more

real-time slack webrtc

Affected surfaces

auth rbac

Summary

AI summary

Security hotfix addressing exported data HTML injection and adding missing permission check to POST /api/v1/fingerprint.

Full changelog

Bump @rocket.chat/meteor version.
(#40920 by @dionisio-bot) Escapes HTML tags in exported data
(#40895 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)
(#40907 by @dionisio-bot) Fixes missing permission check on the POST /api/v1/fingerprint endpoint
Updated dependencies []:
- @rocket.chat/[email protected]
- @rocket.chat/[email protected]

Security Hotfix – escapes HTML tags in exported data to prevent injection (details: https://docs.rocket.chat/docs/security-fixes-and-updates)
Adds missing permission check on POST /api/v1/fingerprint endpoint

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track Rocket.Chat

Get notified when new releases ship.

About Rocket.Chat

The Secure CommsOS™ for mission-critical operations