From 8ea8fb5e4c3aaa0424195ae532f05c9df694ecc1 Mon Sep 17 00:00:00 2001
From: Julio Araujo <julio.araujo@rocket.chat>
Date: Tue, 18 Aug 2026 13:30:19 +0200
Subject: [PATCH] fix: forgot password email DDP method doesn't have strict
 rate limits (#41699)

---
 .changeset/fuzzy-ends-refuse.md                     |  5 +++++
 .../server/methods/sendForgotPasswordEmail.ts       | 13 +++++++++++++
 2 files changed, 18 insertions(+)
 create mode 100644 .changeset/fuzzy-ends-refuse.md

diff --git a/.changeset/fuzzy-ends-refuse.md b/.changeset/fuzzy-ends-refuse.md
new file mode 100644
index 0000000000000..8ddb46f9b3fc7
--- /dev/null
+++ b/.changeset/fuzzy-ends-refuse.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Adds per-client rate limiting to the unauthenticated sendForgotPasswordEmail method, matching the REST users.forgotPassword endpoint
diff --git a/apps/meteor/server/methods/sendForgotPasswordEmail.ts b/apps/meteor/server/methods/sendForgotPasswordEmail.ts
index 6d7706d25c7ba..2da7e49b5c44f 100644
--- a/apps/meteor/server/methods/sendForgotPasswordEmail.ts
+++ b/apps/meteor/server/methods/sendForgotPasswordEmail.ts
@@ -2,6 +2,7 @@ import type { ServerMethods } from '@rocket.chat/ddp-client';
 import { Users } from '@rocket.chat/models';
 import { Accounts } from 'meteor/accounts-base';
 import { check } from 'meteor/check';
+import { DDPRateLimiter } from 'meteor/ddp-rate-limiter';
 import { Meteor } from 'meteor/meteor';
 
 import { settings } from '../../app/settings/server';
@@ -44,3 +45,15 @@ Meteor.methods<ServerMethods>({
 		return sendForgotPasswordEmail(to);
 	},
 });
+
+DDPRateLimiter.addRule(
+	{
+		type: 'method',
+		name: 'sendForgotPasswordEmail',
+		clientAddress() {
+			return true;
+		},
+	},
+	10,
+	60000,
+);