CVE-2022-35247 Missing authorization in Rocket.Chat

What is CVE-2022-35247?

CVE-2022-35247 is a medium-severity missing authorization vulnerability in Rocket.chat Rocket.chat, published on 23 Sep 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A information disclosure vulnerability exists in Rocket.chat <v5, <v4.8.2 and <v4.7.5 where the lack of ACL checks in the getRoomRoles Meteor method leak channel members with special roles to unauthorized clients.

Weakness: CWE-862, CWE-200

Which versions are affected by CVE-2022-35247?

It affects 1 product.

Products include Rocket.chat Rocket.chat.

How do I fix CVE-2022-35247?

No fix has been published for CVE-2022-35247 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2022-35247 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-35247 exists.

Other vulnerabilities in Rocket.chat Rocket.chat

• CVE-2026-58066 Auth bypass in Rocket.Chat Critical 9.8
• CVE-2026-29198 SQL injection in Rocket.Chat Critical 9.8
• CVE-2023-28316 Security feature bypass in Rocket.Chat Critical 9.8
• CVE-2022-44567 Command injection in Rocket.chat - Electron Desktop Critical 9.8
• CVE-2021-22910 Code injection in Rocket.Chat server Critical 9.8

All Rocket.chat Rocket.chat vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-j8gh-qgf7-j54p.