UpHeron
All vulnerabilities

Servers and applications

CVE-2025-7974

rocket.chat Incorrect Authorization Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of rocket.chat. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP port 3000 by default. The issue results from incorrect authorization. An…

Severity
High 7.5
Published
2 Sept 2025
Last changed
19 Oct 2026
Added to UpHeron
1 Nov 2026
Fixed in
7.4.4, 7.5.3, 7.6.4, 7.7.2, 7.8.0
Sources
NVD

Affected software

SoftwareAffected versions
Rocket.ChatServers and applications · cpe:a:rocket.chat:rocket.chat
  • From 7.4.0 before 7.4.4
  • From 7.5.0 before 7.5.3
  • From 7.6.0 before 7.6.4
  • From 7.7.0 before 7.7.2
  • After 7.7.2 before 7.8.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-7974
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-7974