Predicting MongoDB ObjectId continuously in Rocket.Chat

Aikido's AI pentest discovered an unauthenticated IDOR in Rocket.Chat where the file retrieval endpoint did not verify that a file's stored room matched the room parameters used for access checks; combined with the predictability of MongoDB ObjectId() (timestamp, per-process random, incrementing counter), the researchers built an async probe/enumeration PoC that can continuously discover and download all uploaded files on vulnerable instances. The issue was reported and fixed (versions listed in the report) and the authors recommend upgrading immediately and avoiding reliance on ObjectId() for secrecy (use UUIDv4 and proper file-to-room verification).