≤ 3.6.0
Unauthenticated attackers can rename "rooms" of arbitrary users.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.