CVE-2022-32219 Information disclosure in Rocket.Chat

Q: Is CVE-2022-32219 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-32219 exists.

Q: How do I fix CVE-2022-32219?

No fix has been published for CVE-2022-32219 yet. Limit exposure of the affected software until one is available.

Medium 4.3 Published 23 Sep 2022 Updated 22 May 2025

Authenticated users can access sensitive data of other users via the users.list REST endpoint due to improper input validation.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-32219?

CVE-2022-32219 is a medium-severity vulnerability in Rocket.chat Rocket.chat, published on 23 Sep 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

An information disclosure vulnerability exists in Rocket.Chat <v4.7.5 which allowed the "users.list" REST endpoint gets a query parameter from JSON and runs Users.find(queryFromClientSide). This means virtually any authenticated user can access any data (except password hashes) of any user authenticated.

Weakness: CWE-200

Which versions are affected by CVE-2022-32219?

It affects 1 product.

Products include Rocket.chat Rocket.chat.

How do I fix CVE-2022-32219?

No fix has been published for CVE-2022-32219 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-32219 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-32219 exists.

All Rocket.chat Rocket.chat vulnerabilities

Sources

Also known as GHSA-4w54-c3hg-qqrv.