ANT-2026-QXNF2N9K · rocketchat/rocket.chat

auth-bypass high

CVE-2026-48929

Severity Claude high · Security research firm high · Maintainer high

Discovered by Claude Mythos Preview

REPORT

Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ophion Security.

ANT-2026-QXNF2N9K: Unauthenticated Arbitrary File Deletion via `deleteFileMessage` Meteor Method

A completely unauthenticated attacker can permanently delete any file attachment uploaded to any Rocket.Chat room — including files in private channels, direct messages, and admin-only rooms — by invoking the deleteFileMessage Meteor method through the /api/v1/method.callAnon/:method REST endpoint.

The root cause is a broken authorization guard in deleteFileMessage that only performs a permission check when a user ID is present. When the method is invoked anonymously, Meteor.userId() returns null, the guarded branch is skipped, and execution falls through to an unprotected FileUpload.deleteById() call.

The irony: being unauthenticated grants more destructive power than being a logged-in low-privilege user.

Target

Project: rocketchat
Commit: 7b641d319bab2cd9
Location: apps/meteor/app/lib/server/functions/deleteMessage.ts:13
Discovery: static analysis — not yet dynamically reproduced

Technical Details

Line 23's compound condition if (msg && userId) is a fail-open guard: when userId is null (anonymous invocation), the permission-validating branch is skipped and line 27 calls FileUpload.deleteById(fileID) directly, which performs no owner or room ACL check. The method.callAnon route (misc.ts:534-576) has authRequired: false and no method allowlist, so deleteFileMessage is reachable with zero credentials. Net effect: being unauthenticated grants more destructive power than being a logged-in low-privilege user.

Reproduction

This finding was identified by static analysis and has not yet been dynamically reproduced. The Technical Details section above describes the code path; a trigger input is not included.

[No reproducer or sanitizer output attached — request from security-cvd@anthropic.com if needed.]

Acknowledgement

This vulnerability was discovered by Claude, Anthropic's AI assistant, and triaged by the Anthropic security team in collaboration with Anthropic Research. Please direct questions to security-cvd@anthropic.com and reference ANT-2026-QXNF2N9K.

Reference: ANT-2026-QXNF2N9K
Anthropic CVD Policy: https://www.anthropic.com/coordinated-vulnerability-disclosure

SECURITY RESEARCH FIRM ANALYSIS

Triage and disclosure were performed by Ophion Security.

Verdict: true positive
Severity: high

TIMELINE

Dates from discovery through public reveal.

2026-03-30 Reported to tracker
2026-04-25 Sent to maintainer
2026-05-09 Maintainer acknowledged
2026-06-10 Patch released
2026-08-17 Publicly revealed

PROVENANCE

SHA-3-512 hash:

7f41196694c65ea6357c1f9c2b8ccd820fe8ebe3738c83fcf418fafc8335eebe0059f820e31e58377599b8af68aa3097f53780f7714fe1a60401ad59fc28175b

Committed 2026-04-25 00:05 PT

Revealed 2026-08-17 10:47 PT

Verify (download preimage.json)

Show preimage JSON

{
  "ant_id": "ANT-2026-QXNF2N9K",
  "bug_class": "Authentication-bypass",
  "claude_severity": "high",
  "commit_sha": "7b641d319bab2cd9",
  "created_at": "2026-03-30T23:20:41+00:00",
  "description": "A completely unauthenticated attacker can permanently delete any file attachment uploaded to any Rocket.Chat room — including files in private channels, direct messages, and admin-only rooms — by invoking the `deleteFileMessage` Meteor method through the `/api/v1/method.callAnon/:method` REST endpoint.\n\nThe root cause is a broken authorization guard in `deleteFileMessage` that **only performs a permission check when a user ID is present**. When the method is invoked anonymously, `Meteor.userId()` returns `null`, the guarded branch is skipped, and execution falls through to an unprotected `FileUpload.deleteById()` call.\n\nThe irony: being **unauthenticated** grants *more* destructive power than being a logged-in low-privilege user.",
  "discovered_at": null,
  "location": "apps/meteor/app/lib/server/functions/deleteMessage.ts:13",
  "poc_sha256": "9313af1c30072fba3ed504fea55c98d5484d97d9fe858d992c925bf42057f298",
  "preimage_version": 1,
  "project": "rocketchat",
  "reproduction": null,
  "technical_details": "Line 23's compound condition `if (msg && userId)` is a fail-open guard: when userId is null (anonymous invocation), the permission-validating branch is skipped and line 27 calls FileUpload.deleteById(fileID) directly, which performs no owner or room ACL check. The method.callAnon route (misc.ts:534-576) has authRequired: false and no method allowlist, so deleteFileMessage is reachable with zero credentials. Net effect: being unauthenticated grants more destructive power than being a logged-in low-privilege user.",
  "title": "Unauthenticated Arbitrary File Deletion via `deleteFileMessage` Meteor Method",
  "vendor_severity": "high"
}