VYPR
← All advisories
High severity7.7OSV Advisory· Published Jan 14, 2026· Updated Jun 17, 2026

CVE-2026-23477

CVE-2026-23477

Description

Rocket.Chat is an open-source, secure, fully customizable communications platform. In Rocket.Chat versions up to 6.12.0, the API endpoint GET /api/v1/oauth-apps.get is exposed to any authenticated user, regardless of their role or permissions. This endpoint returns an OAuth application, as long as the user knows its ID, including potentially sensitive fields such as client_id and client_secret. This vulnerability is fixed in 6.12.0.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • RocketChat/Rocket.chatOSV3 versions
    0.10.0, 0.10.1, 0.10.2, …+ 2 more
    • (no CPE)range: 0.10.0, 0.10.1, 0.10.2, …
    • cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:*range: <6.12.0
    • (no CPE)range: <=6.12.0

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.