description: A information disclosure vulnerability exists in Rocket.Chat <v5 where the getUserMentionsByChannel meteor server method discloses messages from private channels and direct messages regardless of the users access permission to the room.
problem types: Information Disclosure (CWE-200)
affected:
{
product: Rocket.Chat
vendor: n/a
versions:
status: affected, version: Fixed in version 5.0>
}