CVE-2025-7974 rocket.chat Incorrect Authorization Information Disclosure Vulnerability

What is CVE-2025-7974?

CVE-2025-7974 is a low-severity missing authorization vulnerability in Rocket.chat Rocket.chat, published on 2 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

rocket.chat Incorrect Authorization Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of rocket.chat. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the web service, which listens on TCP port 3000 by default. The issue results from incorrect authorization. An attacker can leverage this vulnerability to disclose information in the context of the application. Was ZDI-CAN-26517.

Weakness: CWE-863

Which versions are affected by CVE-2025-7974?

It affects 1 product.

Products include Rocket.chat Rocket.chat.

How do I fix CVE-2025-7974?

No fix has been published for CVE-2025-7974 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2025-7974 being exploited?

There is no known exploitation of CVE-2025-7974 in the wild and no public exploit code.

Other vulnerabilities in Rocket.chat Rocket.chat

• CVE-2026-58066 Auth bypass in Rocket.Chat Critical 9.8
• CVE-2026-29198 SQL injection in Rocket.Chat Critical 9.8
• CVE-2023-28316 Security feature bypass in Rocket.Chat Critical 9.8
• CVE-2022-44567 Command injection in Rocket.chat - Electron Desktop Critical 9.8
• CVE-2021-22910 Code injection in Rocket.Chat server Critical 9.8

All Rocket.chat Rocket.chat vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3fwv-m349-pfjm.