CVE-2026-30831 is a critical flaw (CVSS 9.8) in Rocket.Chat. The enterprise DDP Streamer login does not enforce two-factor authentication or check whether an account is active, so deactivated users can sign in. Fixed releases are 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1 and 8.2.0.
What's affected
The GitHub advisory lists affected versions as earlier than 8.2.0, 8.1.1, 8.0.2, 7.13.4, 7.12.5, 7.11.5 and 7.10.8, and patched versions as those same numbers. In practice, find your release line and move to the fixed version for it:
- 7.10.x: 7.10.8
- 7.11.x: 7.11.5
- 7.12.x: 7.12.5
- 7.13.x: 7.13.4
- 8.0.x: 8.0.2
- 8.1.x: 8.1.1
- 8.2: 8.2.0
The advisory ties the bug to the enterprise DDP Streamer service, so check whether that component is deployed in your environment.
How to check if you're exposed
Find your server version in the admin panel under Info, or from the host:
docker ps --format '{{.Image}}' | grep -i rocket
Then find out whether you run the DDP Streamer, which is part of the enterprise microservices deployment. If your deployment uses a single monolith without that service, read the advisory to confirm your exposure. Also check whether 2FA is mandatory for your users and whether you have deactivated accounts that should be locked out.
What to do now
- Upgrade Rocket.Chat to the fixed release for your line, from the list above.
- If you run microservices, update the account service and DDP Streamer images to the same release.
- Review authentication logs for sign-ins by deactivated users or sign-ins that skipped a second factor.
- Reset passwords for sensitive accounts if you see anything unexpected, and confirm that deactivated users cannot log in after the upgrade.
- Track your chat platform in a dependency and image inventory so release notes reach the right people.
Why it matters
The advisory says the account service login method skips checks that the standard Meteor login flow performs. Two are named: verifying the TOTP code, and confirming the user is active. The record classes this as CWE-287, improper authentication, and CWE-304, a missing critical step in authentication.
The impact described is practical. Deactivated users, such as former employees, might still log in. Without 2FA enforced, a password spraying attack could lead to account takeover. The advisory's long term advice is to consolidate authentication logic so every login path uses the same controls, and to add integration tests that prove it. Any system with more than one login route has this risk. The record does not mark this as exploited in the wild.
The advisory says the issue was found by an AI agent from the GitHub Security Lab and reviewed by its team.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which versions fix it?
Use the fixed release for your line: 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1 or 8.2.0.
Does this affect users who have 2FA turned on?
The advisory says the DDP Streamer login did not enforce 2FA, so having it enabled for the account is not enough on that path until you patch.
Sources
Last reviewed: 19 October 2026.
