Rocket.Chat is an open-source, secure, fully customizable communications platform. In Rocket.Chat versions up to 6.12.0, the API endpoint GET /api/v1/oauth-apps.get is exposed to any authenticated user, regardless of their role or permissions. This endpoint returns an OAuth application, as long as the user knows its ID, including potentially sensitive fields such as client_id and client_secret. This vulnerability is fixed in 6.12.0.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Wed, 14 Jan 2026 18:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Rocket.Chat is an open-source, secure, fully customizable communications platform. In Rocket.Chat versions up to 6.12.0, the API endpoint GET /api/v1/oauth-apps.get is exposed to any authenticated user, regardless of their role or permissions. This endpoint returns an OAuth application, as long as the user knows its ID, including potentially sensitive fields such as client_id and client_secret. This vulnerability is fixed in 6.12.0. | |
| Title | Rocket.Chat Unauthorized Access to OAuth App Details | |
| Weaknesses | CWE-269 CWE-862 |
|
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-01-14T18:16:05.178Z
Reserved: 2026-01-13T15:47:41.627Z
Link: CVE-2026-23477
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-01-14T19:16:47.990
Modified: 2026-01-14T19:16:47.990
Link: CVE-2026-23477
Redhat
No data.
OpenCVE Enrichment
No data.