Pain point · Permissions & security · Causes churn
Push token registration lets users overwrite another user's device
1 source thread · first seen 2026-10
Summary
The push-token endpoint accepts a client-supplied ID without verifying document ownership, allowing a user to replace another user's notification token. This can divert the victim's message notifications to an attacker's device.
- Affects
- Rocket.Chat users whose push-token documents can be targeted
Evidence
Excerpts are copied word for word from the source; follow the link to read it in full.
“A regular user can therefore rewrite another user's push-registration document”