What is GHSA-2v6f-4wc2-p3hq?

GHSA-2v6f-4wc2-p3hq is a security advisory published by GitHub Security Advisories with High severity. The Rocket.Chat DDP method autoTranslate.translateMessage in versions \u003c8.5.0, \u003c8.4.2, \u003c8.3.4, \u003c8...

Which CVE IDs does GHSA-2v6f-4wc2-p3hq cover?

GHSA-2v6f-4wc2-p3hq covers the following CVE IDs: CVE-2026-32995. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-2v6f-4wc2-p3hq?

GHSA-2v6f-4wc2-p3hq has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

GHSA-2v6f-4wc2-p3hqHighCVSS 7.5

The Rocket.Chat DDP method autoTranslate.translateMessage in versions <8.5.0, <8.4.2, <8.3.4, <8...

Vendor

GitHub Security Advisories

Published

May 28, 2026

Last Modified

May 28, 2026

🔗 CVE IDs covered (1)

CVE-2026-32995 →

📋 Description

The Rocket.Chat DDP method autoTranslate.translateMessage in versions <8.5.0, <8.4.2, <8.3.4, <8.2.4, <8.1.5, <8.0.5, <7.13.8, and <7.10.12 accepts a client-supplied IMessage object and passes it directly to translateMessage() without checking Meteor.userId() or verifying room membership. Any authenticated DDP user can read the content of any message by ID from any room (private channels, DMs, E2EE rooms) by calling this method.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-32995
https://github.com/RocketChat/Rocket.Chat/pull/40528
https://hackerone.com/reports/3734326
https://github.com/advisories/GHSA-2v6f-4wc2-p3hq