{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-29197", "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "state": "PUBLISHED", "assignerShortName": "hackerone", "dateReserved": "2026-03-04T15:00:09.266Z", "datePublished": "2026-04-23T23:19:40.722Z", "dateUpdated": "2026-04-23T23:19:40.722Z"}, "containers": {"cna": {"descriptions": [{"lang": "en", "value": "In versions <8.4.0, <8.3.2, <8.2.2, <8.1.3, <8.0.4, <7.13.6, <7.12.7, <7.11.7, and <7.10.10, the endpoints /api/apps/logs and /api/apps/:id/logs have a typo in the required permission check, allowing authenticated users without the proper permissions to read apps-engine logs."}], "affected": [{"defaultStatus": "unaffected", "vendor": "Rocket.Chat", "product": "Rocket.Chat", "versions": [{"version": "8.4.0", "status": "affected", "lessThan": "8.4.0", "versionType": "semver"}, {"version": "8.3.2", "status": "affected", "lessThan": "8.3.2", "versionType": "semver"}, {"version": "8.2.2", "status": "affected", "lessThan": "8.2.2", "versionType": "semver"}, {"version": "8.1.3", "status": "affected", "lessThan": "8.1.3", "versionType": "semver"}, {"version": "8.0.4", "status": "affected", "lessThan": "8.0.4", "versionType": "semver"}, {"version": "7.13.6", "status": "affected", "lessThan": "7.13.6", "versionType": "semver"}, {"version": "7.12.7", "status": "affected", "lessThan": "7.12.7", "versionType": "semver"}, {"version": "7.11.7", "status": "affected", "lessThan": "7.11.7", "versionType": "semver"}, {"version": "7.10.10", "status": "affected", "lessThan": "7.10.10", "versionType": "semver"}]}], "references": [{"url": "https://hackerone.com/reports/3589551"}, {"url": "https://github.com/RocketChat/Rocket.Chat/pull/40125"}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "cweId": "CWE-284", "description": "CWE-284 Improper Access Control - Generic"}]}], "providerMetadata": {"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone", "dateUpdated": "2026-04-23T23:19:40.722Z"}}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "In versions <8.4.0, <8.3.2, <8.2.2, <8.1.3, <8.0.4, <7.13.6, <7.12.7, <7.11.7, and <7.10.10, the endpoints /api/apps/logs and /api/apps/:id/logs have a typo in the required permission check, allowing authenticated users without the proper permissions to read apps-engine logs."}], "id": "CVE-2026-29197", "lastModified": "2026-04-24T00:16:27.647", "metrics": {}, "published": "2026-04-24T00:16:27.647", "references": [{"source": "support@hackerone.com", "url": "https://github.com/RocketChat/Rocket.Chat/pull/40125"}, {"source": "support@hackerone.com", "url": "https://hackerone.com/reports/3589551"}], "sourceIdentifier": "support@hackerone.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "support@hackerone.com", "type": "Secondary"}]}

{}

{}