Rocket.Chat Permission Bypass Vulnerability in Apps Engine Log Endpoints

A vulnerability exists in Rocket.Chat versions prior to 8.4.0, 8.3.2, 8.2.2, 8.1.3, 8.0.4, 7.13.6, 7.12.7, 7.11.7, and 7.10.10. The issue arises from a typo in the permission check for the endpoints '/api/apps/logs' and '/api/apps/:id/logs'. This flaw allows authenticated users without the necessary permissions to access apps-engine logs, including admin-only logs for Enterprise Apps.

Impact

Exploitation of this vulnerability allows for unauthorized access to sensitive log information, potentially including private data or details about application performance and errors.