CVE-2026-66750
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
Let's Chat versions 0.3.0 through 0.4.8 contain a broken access control vulnerability that allows authenticated attackers to download file attachments from private and password-protected rooms they are not a member of by exploiting missing room membership checks in the file retrieval route.
Risk Assessment
An attacker can enumerate adjacent MongoDB ObjectIds to recover files uploaded by other users, leading to disclosure of sensitive data.
Recommendation
Update Let's Chat to version 0.4.9 or later that fixes this vulnerability, or apply a workaround by adding room membership checks in the file retrieval route.
Other vulnerabilities in Let's Chat
See all- CVE-2026-66751Medium
Let's Chat versions 0.3.0 through 0.4.8 contain an improper authorization vulnerability that allows any authenticated user to archive any room on the server by sending a DELETE request to the rooms handler without ownership verification.
- CVE-2026-66749Medium
Let's Chat versions 0.4.0 through 0.4.8 contain a null dereference vulnerability that allows authenticated attackers to crash the server by supplying a valid 24-character hex string room parameter that matches no document in the database.
Original NVD description (English source)
Let's Chat 0.3.0 through 0.4.8 contains a broken access control vulnerability that allows authenticated attackers to download file attachments from private and password-protected rooms they are not a member of by exploiting missing room membership checks in the file retrieval route. Attackers can enumerate adjacent MongoDB ObjectIds derived from a known file ID to recover files uploaded by other users, as the GET /files/:id/:name route in app/controllers/files.js only enforces login authentication without consulting room membership or the Room.canJoin check.