CVE-2026-66751
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
Let's Chat versions 0.3.0 through 0.4.8 contain an improper authorization vulnerability that allows any authenticated user to archive any room on the server by sending a DELETE request to the rooms handler without ownership verification.
Risk Assessment
An attacker can permanently archive private or password-protected rooms they cannot access, leading to data loss and no recovery path without database intervention.
Recommendation
Update Let's Chat to version 0.4.9 or later that fixes this vulnerability, or apply a workaround by restricting API access to trusted users only.
Other vulnerabilities in Let's Chat
See all- CVE-2026-66750Medium
Let's Chat versions 0.3.0 through 0.4.8 contain a broken access control vulnerability that allows authenticated attackers to download file attachments from private and password-protected rooms they are not a member of by exploiting missing room membership checks in the file retrieval route.
- CVE-2026-66749Medium
Let's Chat versions 0.4.0 through 0.4.8 contain a null dereference vulnerability that allows authenticated attackers to crash the server by supplying a valid 24-character hex string room parameter that matches no document in the database.
Original NVD description (English source)
Let's Chat 0.3.0 through 0.4.8 contains an improper authorization vulnerability that allows any authenticated user to archive any room on the server by sending a DELETE request to the rooms handler without ownership verification. Attackers can enumerate room IDs via the rooms listing endpoint and permanently archive private or password-protected rooms they cannot access, with no application-level recovery path requiring direct database intervention to restore.