{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "introduced": "0"
              },
              {
                "fixed": "7.10.15"
              },
              {
                "introduced": "8.0.0"
              },
              {
                "fixed": "8.1.8"
              },
              {
                "introduced": "8.2.0"
              },
              {
                "fixed": "8.2.8"
              },
              {
                "introduced": "8.3.0"
              },
              {
                "fixed": "8.3.8"
              },
              {
                "introduced": "8.4.0"
              },
              {
                "fixed": "8.4.6"
              },
              {
                "introduced": "8.5.0"
              },
              {
                "fixed": "8.5.3"
              },
              {
                "introduced": "8.6.0"
              },
              {
                "fixed": "8.6.2"
              }
            ],
            "source": [
              "AFFECTED_FIELD",
              "REFERENCES"
            ]
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "introduced": "9e2e148b8d8c474b307c24d59f8592a172f017f5"
            },
            {
              "introduced": "f2a05ceed2086266fa3e36cf575c1794f68f00ab"
            },
            {
              "introduced": "00a1efa3fde455359510349d827acd91ba67905e"
            },
            {
              "introduced": "bb8c7be629b7cbffc7387285c5cb98e5835ad85f"
            },
            {
              "introduced": "d0230e1ed86163b5cf9da57fda09fa86ea0b5c9f"
            },
            {
              "introduced": "814435ab3573909034a97dc70328dadea3793a1c"
            },
            {
              "fixed": "477ae4ae3928796b2c71c1db1a5ba2e848561300"
            },
            {
              "fixed": "687c4e27ea0e95e7631a64ce27e2debcd5d76c14"
            },
            {
              "fixed": "16a2a0809c35a44233fce3c608e2e7878ebf03e2"
            },
            {
              "fixed": "7ce1a49d686463656a3993c9c536b03104527c39"
            },
            {
              "fixed": "b7279c54f80a23e4499a69acee75af3ec647249b"
            },
            {
              "fixed": "7e36cbd4c1aa29a691e3fec9827537430b2f346a"
            },
            {
              "fixed": "620394519991542b13db82e361dcb0c3e2014c1e"
            },
            {
              "fixed": "3a61c3afe"
            }
          ],
          "repo": "https://github.com/rocketchat/rocket.chat",
          "type": "GIT"
        }
      ]
    }
  ],
  "aliases": [
    "GHSA-7c6v-m68v-v73r"
  ],
  "database_specific": {
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
      "CWE-204",
      "CWE-307"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/75xxx/CVE-2026-75575.json",
    "unresolved_ranges": [
      {
        "extracted_events": [
          {
            "introduced": "8.7.0"
          },
          {
            "fixed": "8.7.2"
          },
          {
            "introduced": "8.8.0-rc.0"
          },
          {
            "fixed": "8.8.0"
          }
        ],
        "source": "AFFECTED_FIELD"
      }
    ]
  },
  "details": "Rocket.Chat exposes the sendForgotPasswordEmail Meteor method without a DDP rate limit, so an unauthenticated caller may invoke it as often as it likes. The method is reachable over DDP and over the HTTP route POST /api/v1/method.callAnon/sendForgotPasswordEmail, and it triggers a password reset message for any address that matches an account. With no DDPRateLimiter rule registered for it, a caller can drive an unbounded volume of reset mail at a chosen address from the deployment's own mail sender, and can probe addresses at scale: the method answers true for an address with no account and for a successful send, but false when the address belongs to an account that authenticates through an external provider and Accounts_AllowPasswordChangeForOAuthUsers is off, so repeated calls distinguish that class of account. Later versions register a rule permitting ten calls per minute per client address.",
  "id": "CVE-2026-75575",
  "modified": "2026-08-27T11:30:23.204932238Z",
  "published": "2026-08-25T01:30:29.898Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/75xxx/CVE-2026-75575.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-7c6v-m68v-v73r"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75575"
    },
    {
      "type": "ADVISORY",
      "url": "https://www.vulncheck.com/advisories/rocket-chat-missing-ddp-rate-limit-on-the-sendforgotpasswordemail-meteor-method"
    },
    {
      "type": "FIX",
      "url": "https://github.com/RocketChat/Rocket.Chat/commit/3a61c3afe"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/RocketChat/Rocket.Chat"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Rocket.Chat Missing DDP Rate Limit on the sendForgotPasswordEmail Meteor Method"
}