Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Rocket.Chat

Bug bounty on Sorona rocket.chat

Accepting reports open-source
Go to program Website
Top reward
$1,500
Top severity paid
Critical
Assets in scope
15
Public CVEs
2
Last change
No changes yet

At a glance

What to know before you start testing.

Pays from $1,500
for critical bugs.
Report on Sorona
Submit through the program page.
Partial safe harbor
Some legal protection; read the terms.
Publish after a fix
Coordinate the timing with the company.

Rewards

What Sorona lists as the payout for each severity.

Severity Reward
Critical $1,500+
High $700+
Medium $300+
Low $100 $100 / 1 month Claude Max
Safe harbor
Partial Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Hall of fame
Yes The policy asks researchers to refrain from seeking compensation and offers public recognition in a White Hat Hall of Fame.

Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

15 assets you may test, 6 excluded.

Web 1

  • https://www.rocket.chat

Products and areas 14

  • Authentication in full: local accounts, OAuth and OpenID Connect providers, SAML, LDAP, CAS, two-factor and the login rate limiting in front of all of them
  • Channel, private group, discussion and team permission evaluation, including membership, mentions, search, read receipts and anything that surfaces content from a room the caller has not joined
  • Email flows, invitations and the registration and password reset paths
  • Federation and the matrix bridge where enabled
  • File upload, storage and the access checks on retrieval, across every configured storage backend
  • Livechat and the omnichannel surface, which is exposed to the public internet by design and shares the server with everything else
  • Message rendering: markdown, embeds, code blocks, custom emoji and the link preview fetcher that reaches out on a user's behalf
  • Push notification handling and what leaves the server for a third-party gateway
  • The apps engine and the marketplace, incoming and outgoing integrations, and the scripts an integration is allowed to run
  • The OAuth server Rocket.Chat can itself act as for other applications
  • The responsible disclosure policy accepts reports through the HackerOne vulnerability disclosure programme or at [email protected] and recognises reporters in a Hall of Fame. It declares no boundary narrower than the product
  • The REST API and the Meteor method surface behind the UI, which is the larger of the two and reachable directly over the websocket
  • The roles and permissions model, the admin panel and every setting an administrator can change on a running server
  • The server surface the mobile and desktop clients depend on, including the CDN and asset paths
Out of scope (6)
  • A channel or team an administrator deliberately made public, or a permission they deliberately granted
  • Findings against an unsupported release, since fixes land on the supported minor versions
  • MongoDB and the rest of the deployment stack underneath the application
  • Rocket.Chat Cloud infrastructure, which is a hosted service and a separate asset
  • The mobile app store distribution and device-level attacks
  • Third-party apps from the marketplace that the project does not maintain

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy. "We" in these lines means Sorona, not this site.

While testing

  • Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly.
  • Report through the Rocket.Chat vulnerability disclosure programme on HackerOne, or by email to the address on the policy page .
  • Say whether the finding reproduces through the REST API or through a Meteor method.
  • Give the exact roles and channel memberships of every account involved
  • State whether livechat or omnichannel was enabled

Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 1 hour ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD
CVESeverityPublished
CVE-2021-29935 High 7.3 1 Apr 2021
CVE-2020-35882 High 8.1 31 Dec 2020

Original policy

Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.

Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 16 Last 12 months Access control 35 % Auth bypass 25 % Cross-site scripting 20 % SSRF 20 % Latest advisories Loading the feed Overview Rocket.Chat is the self-hosted team chat platform organisations deploy when messages cannot leave their own infrastructure, including air-gapped and regulated environments in a long list of countries. What it holds is the internal conversation of an entire organisation plus every file dropped into it. A defect in channel access control or in the authentication path reads that archive in one go. Rocket.Chat's disclosure policy asks researchers to refrain from seeking compensation and offers a Hall of Fame listing instead, and its HackerOne programme carries no bounty. sorona.xyz pays you directly on qualified, reproduced findings. In scope The responsible disclosure policy accepts reports through the HackerOne vulnerability disclosure programme or at [email protected] and recognises reporters in a Hall of Fame. It declares no boundary narrower than the product Authentication in full: local accounts, OAuth and OpenID Connect providers, SAML, LDAP, CAS, two-factor and the login rate limiting in front of all of them The REST API and the Meteor method surface behind the UI, which is the larger of the two and reachable directly over the websocket Channel, private group, discussion and team permission evaluation, including membership, mentions, search, read receipts and anything that surfaces content from a room the caller has not joined The roles and permissions model, the admin panel and every setting an administrator can change on a running server File upload, storage and the access checks on retrieval, across every configured storage backend The apps engine and the marketplace, incoming and outgoing integrations, and the scripts an integration is allowed to run Livechat and the omnichannel surface, which is exposed to the public internet by design and shares the server with everything else Federation and the matrix bridge where enabled Message rendering: markdown, embeds, code blocks, custom emoji and the link preview fetcher that reaches out on a user's behalf Push notification handling and what leaves the server for a third-party gateway Email flows, invitations and the registration and password reset paths The OAuth server Rocket.Chat can itself act as for other applications The server surface the mobile and desktop clients depend on, including the CDN and asset paths Out of scope Rocket.Chat Cloud infrastructure, which is a hosted service and a separate asset Third-party apps from the marketplace that the project does not maintain A channel or team an administrator deliberately made public, or a permission they deliberately granted MongoDB and the rest of the deployment stack underneath the application The mobile app store distribution and device-level attacks Findings against an unsupported release, since fixes land on the supported minor versions Most-valued findings Authorization defects where a user reads messages, files or membership outside the rooms they belong to, including through the REST API, search and the Meteor methods the UI never calls Authentication bypass in OAuth, OpenID Connect, SAML or LDAP, above all identity binding that attaches an attacker-controlled external identity to an existing account The livechat and omnichannel paths, which accept unauthenticated input from the public internet into the same process that serves the organisation's private history Server-side request forgery from the link preview fetcher, outgoing integrations or the apps engine, all of which fetch URLs a user or an operator supplies from a server sitting inside the network The apps and integration scripting surface, where a script reaches beyond its sandbox into the server process or the database Stored cross-site scripting in message rendering, custom emoji or file previews, escalating to API calls in an administrator's session File upload and retrieval paths serving an attachment to someone outside the room it was posted in Privilege escalation through the roles model, from ordinary user to admin on a server holding the whole organisation's history The OAuth server surface, since a defect there hands identity to other applications that trust Rocket.Chat as their provider Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Report through the Rocket.Chat vulnerability disclosure programme on HackerOne, or by email to [email protected] . The email path stays open when the HackerOne programme is on a break The policy asks researchers to refrain from seeking compensation and offers public recognition in a White Hat Hall of Fame. There is no bounty at any severity Do not confuse this with Mattermost, which does run a paid programme on Bugcrowd for a comparable product Say whether the finding reproduces through the REST API or through a Meteor method. The method surface is larger than the API and is often where authorization checks are missing Give the exact roles and channel memberships of every account involved, since Rocket.Chat's permission model is granular and a finding is only meaningful against a specific pair State whether livechat or omnichannel was enabled, because that surface accepts unauthenticated input from the public internet into the same server Disclosure Coordinated through the HackerOne disclosure programme or the security address, published as a GitHub Security Advisory with a CVE alongside a release. Rocket.Chat ships security fixes across supported minor versions and many deployments are self-hosted and slow to upgrade, so the embargo runs to those releases rather than to a date you choose. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability