Rocket.Chat Missing DDP Rate Limit on the sendForgotPasswordEmail Meteor Method

Summary

Rocket.Chat exposes the sendForgotPasswordEmail Meteor method without a DDP rate limit, so an unauthenticated caller may invoke it as often as it likes. The method is reachable over DDP and over the HTTP route POST /api/v1/method.callAnon/sendForgotPasswordEmail, and it triggers a password reset message for any address that matches an account. With no DDPRateLimiter rule registered for it, a caller can drive an unbounded volume of reset mail at a chosen address from the deployment's own mail sender, and can probe addresses at scale: the method answers true for an address with no account and for a successful send, but false when the address belongs to an account that authenticates through an external provider and Accounts_AllowPasswordChangeForOAuthUsers is off, so repeated calls distinguish that class of account. Later versions register a rule permitting ten calls per minute per client address.

Timeline

1. Aug 25, 2026, 1:30 AM UTCCVE published
2. Aug 25, 2026, 3:25 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: yes · Technical impact: partial

   4 days
3. Aug 29, 2026, 11:47 AM UTCRecord last updated

Affected versions

• RocketChat Rocket.Chat

  fixed in 7.10.15; From 8.0.0 · fixed in 8.1.8; From 8.2.0 · fixed in 8.2.8; From 8.3.0 · fixed in 8.3.8; From 8.4.0 · fixed in 8.4.6; From 8.5.0 · fixed in 8.5.3; From 8.6.0 · fixed in 8.6.2; From 8.7.0 · fixed in 8.7.2; From 8.8.0-rc.0 · fixed in 8.8.0

References 4