<![CDATA[Security bug in 4.0.0]]>https://github.com/RocketChat/Rocket.Chat/issues/23367
Let's wait for the fix. Until then we should stay with the current version 3.18.2
@girish: better stop the rollout of 4.0.0

]]>https://forum.cloudron.io/topic/5762/security-bug-in-4-0-0RSS for NodeMon, 17 Aug 2026 02:08:48 GMTTue, 05 Oct 2021 16:34:40 GMT60<![CDATA[Reply to Security bug in 4.0.0 on Thu, 07 Oct 2021 03:04:26 GMT]]>I have pushed the update to 4.0.1

]]>https://forum.cloudron.io/post/37381https://forum.cloudron.io/post/37381Thu, 07 Oct 2021 03:04:26 GMT<![CDATA[Reply to Security bug in 4.0.0 on Wed, 06 Oct 2021 15:55:54 GMT]]>Looks like 4.0.1 that fixes this will be ready soon

https://github.com/RocketChat/Rocket.Chat/milestone/258

]]>https://forum.cloudron.io/post/37337https://forum.cloudron.io/post/37337Wed, 06 Oct 2021 15:55:54 GMT<![CDATA[Reply to Security bug in 4.0.0 on Tue, 05 Oct 2021 20:53:19 GMT]]>@necrevistonnezr said in Security bug in 4.0.0:

Wow, that’s bad…

Yep, it really is. I just checked my install and it'd already updated to 4.0 and I was able to login as anyone using any password.

Everyone ought to check if their installs of Rocket.Chat and revert to an earlier backup ASAP!

What I love about Cloudron was how quickly I was able to restore a backup and fix this problem all while on my phone.

And of course that we have great people like @luckow in our community who come here and tell us all about the issue in the first place! Thanks! (I wonder if this post could be highlighted somehow? This is a serious security bug)

]]>https://forum.cloudron.io/post/37303https://forum.cloudron.io/post/37303Tue, 05 Oct 2021 20:53:19 GMT<![CDATA[Reply to Security bug in 4.0.0 on Tue, 05 Oct 2021 17:24:32 GMT]]>Wow, that’s bad…

]]>https://forum.cloudron.io/post/37282https://forum.cloudron.io/post/37282Tue, 05 Oct 2021 17:24:32 GMT<![CDATA[Reply to Security bug in 4.0.0 on Tue, 05 Oct 2021 16:44:45 GMT]]>OK, I can reproduce this. People can login with any password 😕 I have revoked the release. I have also left a note on the GitHub issue.

]]>https://forum.cloudron.io/post/37277https://forum.cloudron.io/post/37277Tue, 05 Oct 2021 16:44:45 GMT<![CDATA[Reply to Security bug in 4.0.0 on Tue, 05 Oct 2021 16:36:39 GMT]]>@luckow thanks for the heads up. I have stopped the roll out already but I am trying to reproduce the issue right now.

]]>https://forum.cloudron.io/post/37276https://forum.cloudron.io/post/37276Tue, 05 Oct 2021 16:36:39 GMT