Summary

The POST /api/v1/fingerprint REST endpoint enforces authentication (authRequired: true) but performs no authorization check. Any authenticated user — including a standard user role account — can call this endpoint with {"setDeploymentAs": "new-workspace"} to permanently deregister the workspace from Rocket.Chat Cloud. This wipes all cloud credentials, removes the workspace license, breaks push notifications for all users, and requires manual re-registration to recover.

Root Cause

File: apps/meteor/app/api/server/v1/misc.ts, lines 634–700

The route handler has authRequired: true but performs zero authorization:

API.v1.addRoute('fingerprint', { authRequired: true }, {
  async post() {
    // ❌ No check: no hasPermission('manage-cloud'), no isAdmin(), nothing
    const { setDeploymentAs } = this.bodyParams;

    if (setDeploymentAs === 'new-workspace') {
      await WorkspaceCredentials.removeAllCredentials();         // line 649
      await Settings.updateValueById('Cloud_Workspace_Id', ''); // line 651
      await Settings.updateValueById('Cloud_Workspace_Client_Id', '');
      await Settings.updateValueById('Cloud_Workspace_Client_Secret', '');
      await Settings.updateValueById('Cloud_Workspace_PublicKey', '');
      await Settings.updateValueById('Cloud_Workspace_License', '');
      await Settings.updateValueById('uniqueID', generateUniqueId()); // line 662
    }
  }
});

Contrast with correct pattern (same file, different endpoint):

// cloud.manualSync endpoint — properly authorized
API.v1.addRoute('cloud.manualSync', { authRequired: true }, {
  async post() {
    if (!this.userId) throw new Meteor.Error('error-not-allowed');
    await hasPermissionAsync(this.userId, 'manage-cloud'); // ← correct check
    // ...
  }
});

Impact

An attacker with any valid account on a target Rocket.Chat instance can:

1. Wipe the workspace license — Cloud_Workspace_License cleared; paid features disabled immediately
2. Break push notifications — Cloud_Workspace_Client_Id/Secret cleared; all mobile push delivery stops for every user
3. Sever Rocket.Chat Marketplace access — workspace is no longer recognized; apps stop receiving updates or may be disabled