A critical authorization flaw in Rocket.Chat versions before 6.12.0 allows authenticated users to access sensitive OAuth credentials, posing a significant risk of account and service impersonation.

The vulnerability exists in the API endpoint GET /api/v1/oauth-apps.get, which fails to perform proper authorization checks. Any authenticated user can query this endpoint to retrieve sensitive OAuth information, including client IDs and client secrets, regardless of their assigned permissions.

The exposure of OAuth client secrets grants unauthorized parties the ability to impersonate the Rocket.Chat application or intercept user authentication flows, leading to potential data breaches and unauthorized access to integrated systems. Given the CVSS score of 7.7, this represents a high-severity risk to the confidentiality of organizational communication workflows and third-party service integrations.

Immediate Action: Upgrade Rocket.Chat instances to version 6.12.0 or later to apply the necessary authorization checks and secure the affected API endpoint.

Proactive Monitoring: Audit application access logs for unusual patterns of requests to the /api/v1/oauth-apps.get endpoint, particularly from accounts with standard or low-level privileges.

Compensating Controls: Implement strict API rate limiting and monitor for bulk requests targeting OAuth configuration endpoints to detect potential reconnaissance or exploitation attempts.

Public Exploit Available: Unknown

The risk posed by the unauthorized exposure of OAuth credentials is high, as it provides a vector for lateral movement and service manipulation. Organizations utilizing Rocket.Chat must prioritize the update to version 6.12.0 to remediate this authorization bypass. If an immediate upgrade is not feasible, restrict API access to the affected endpoint at the network or application gateway level until the patch can be applied.