CVE-2026-49278 Rocket.Chat: Livechat Visitor Profile Disclosure Leaks Bearer Token and Enables Visitor Impersonation
Rocket.Chat leaks Bearer tokens in visitor profile responses, allowing attackers to impersonate visitors and access sensitive data.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-49278?
CVE-2026-49278 is a medium-severity vulnerability in RocketChat Rocket.Chat, published on 24 Jun 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12, in the visitors.info endpoint, https://developer.rocket.chat/apidocs/get-visitor-information-by-id-1, token is returned in the response. It looks like there's no use case for the token to be present in the response and it would be a good security practice to remove it altogether. This vulnerability is fixed in 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12.
Weakness: CWE-285
Which versions are affected by CVE-2026-49278?
How do I fix CVE-2026-49278?
No fix has been published for CVE-2026-49278 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-49278 being exploited?
There is no known exploitation of CVE-2026-49278 in the wild and no public exploit code.
Sources
Also known as GHSA-cqj7-h8cj-jmf2.