CVE-2026-32995

HighCVSS 7.5/10Last modified Oct 23, 2026

Description

The Rocket.Chat DDP method autoTranslate.translateMessage in versions <8.5.0, <8.4.2, <8.3.4, <8.2.4, <8.1.5, <8.0.5, <7.13.8, and <7.10.12 accepts a client-supplied IMessage object and passes it directly to translateMessage() without checking Meteor.userId() or verifying room membership. Any authenticated DDP user can read the content of any message by ID from any room (private channels, DMs, E2EE rooms) by calling this method.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-284

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: May 28, 2026
Last modified: Oct 23, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-329967.3This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation.CVE-2026-329978.6A vulnerability allowing an authenticated user with the Backup Administrator role to write arbitrary files on Linux-based Veeam Backup & Rep CVE-2026-329989.4This vulnerability in Veeam Service Provider Console allows for remote code execution.CVE-2026-329999.0Insufficient character filtering in backup agent signing module on Comet Backup server allows authenticated tenant administrator to execute CVE-2026-33009.8The Everest Forms Pro plugin for WordPress is vulnerable to Remote Code Execution via PHP Code Injection in all versions up to, and includin CVE-2026-330009.1A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS CVE-2026-330018.8Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives,CVE-2026-330027.5Jenkins 2.442 through 2.554 (both inclusive), LTS 2.426.3 through LTS 2.541.2 (both inclusive) performs origin validation of requests made t CVE-2026-330034.3Jenkins LoadNinja Plugin 2.1 and earlier stores LoadNinja API keys unencrypted in job config.xml files on the Jenkins controller where they CVE-2026-330044.3Jenkins LoadNinja Plugin 2.1 and earlier does not mask LoadNinja API keys displayed on the job configuration form, increasing the potential CVE-2026-330054.3Improper Handling of Insufficient Privileges vulnerability in Apache OpenMeetings. Any registered user can query web service with their cre CVE-2026-330064.8A timing attack against mod_auth_digest in Apache HTTP Server 2.4.66 allows a bypass of Digest authentication by a remote attacker. Users a