Security readout for executives and security teams
Plain-English summary
Rocket.Chat had an access-control flaw where any logged-in user could request OAuth application details if they knew the app ID. The response could include client_id and client_secret. This is mainly a confidentiality risk: exposed secrets could undermine integrations that rely on those OAuth credentials.
Executive priority
Treat as a high-priority remediation for any Rocket.Chat instance below 6.12.0. The issue can expose integration secrets to ordinary authenticated users, which may create downstream access risk. Prioritize upgrade and credential rotation where sensitive OAuth apps are configured.
Technical view
CVE-2026-23477 affects Rocket.Chat versions before 6.12.0. The authenticated API endpoint GET /api/v1/oauth-apps.get did not properly enforce role or permission checks. The issue maps to CWE-269 and CWE-862, with CVSS 3.1 score 7.7, reflecting network access, low complexity, low privileges, and high confidentiality impact.
Likely exposure
Organizations running Rocket.Chat versions earlier than 6.12.0 are potentially exposed. Exploitation requires an authenticated user and knowledge of an OAuth application ID. Public internet exposure increases business risk, but the provided sources do not confirm exploitation in the wild.
Exploitation context
The source bundle states KEV is false and provides no evidence of active exploitation. The flaw is not unauthenticated; an attacker needs a valid account. Risk increases where broad user registration, weak account controls, or many internal users exist.
Researcher notes
The advisory indicates an authorization failure on a specific authenticated API endpoint. Evidence provided does not include exploit publication, weaponized tooling, or observed exploitation. There is a wording inconsistency in the bundle: it says “up to 6.12.0” but also states fixed in 6.12.0 and affected versions are less than 6.12.0.
Mitigation direction
- Upgrade Rocket.Chat to version 6.12.0 or later.
- Review Rocket.Chat vendor advisory for any additional guidance.
- Rotate OAuth client secrets that may have been exposed.
- Audit OAuth integrations for unexpected use or configuration changes.
- Restrict account creation and remove unnecessary user access.
Validation and detection
- Inventory Rocket.Chat deployments and identify versions below 6.12.0.
- Confirm the vendor fix is applied in production.
- Review logs for access to /api/v1/oauth-apps.get by non-admin users.
- Identify OAuth apps and determine whether secrets require rotation.
- Validate role and permission controls after upgrade.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-269: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-862: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-23477 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.7 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N3.14Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.7HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-g4wm-fg3c-g4p2CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Privilege Management
Improper Privilege Management represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Missing Authorization
Missing Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.