{"id":"CVE-2026-75575","title":"Rocket.Chat exposes the sendForgotPasswordEmail Meteor method without a DDP rate limit, so an unauthenticated caller may invoke it as often as it likes","summary":"Rocket.Chat exposes the sendForgotPasswordEmail Meteor method without a DDP rate limit, so an unauthenticated caller may invoke it as often as it likes. The method is reachable over DDP and over the HTTP route POST /api/v1/method.callAno…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cwe":["CWE-204","CWE-307"],"vendor":"RocketChat","product":"Rocket.Chat","affected":["Rocket.Chat < 7.10.15","Rocket.Chat >= 8.0.0 < 8.1.8","Rocket.Chat >= 8.2.0 < 8.2.8","Rocket.Chat >= 8.3.0 < 8.3.8","Rocket.Chat >= 8.4.0 < 8.4.6","Rocket.Chat >= 8.5.0 < 8.5.3","Rocket.Chat >= 8.6.0 < 8.6.2","Rocket.Chat >= 8.7.0 < 8.7.2","Rocket.Chat >= 8.8.0-rc.0 < 8.8.0"],"published":"2026-08-25","updated":"2026-09-10","sourceUpdated":"2026-09-10T20:46:19.780","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-75575","references":[{"url":"https://github.com/RocketChat/Rocket.Chat","label":"disclosure@vulncheck.com"},{"url":"https://github.com/RocketChat/Rocket.Chat/commit/3a61c3afe","label":"disclosure@vulncheck.com"},{"url":"https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-7c6v-m68v-v73r","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/rocket-chat-missing-ddp-rate-limit-on-the-sendforgotpasswordemail-meteor-method","label":"disclosure@vulncheck.com"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-08-25T15:25:37.838804Z"},"ingestedAt":"2026-09-14T13:16:10.452Z","epss":0.00231,"epssPercentile":0.1425,"slug":"CVE-2026-75575","body":"## Overview\n\nRocket.Chat exposes the sendForgotPasswordEmail Meteor method without a DDP rate limit, so an unauthenticated caller may invoke it as often as it likes. The method is reachable over DDP and over the HTTP route POST /api/v1/method.callAnon/sendForgotPasswordEmail, and it triggers a password reset message for any address that matches an account. With no DDPRateLimiter rule registered for it, a caller can drive an unbounded volume of reset mail at a chosen address from the deployment's own mail sender, and can probe addresses at scale: the method answers true for an address with no account and for a successful send, but false when the address belongs to an account that authenticates through an external provider and Accounts_AllowPasswordChangeForOAuthUsers is off, so repeated calls distinguish that class of account. Later versions register a rule permitting ten calls per minute per client address.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}