CVE-2026-66751: Let's Chat 0.3.0 - 0.4.8 Improper Authorization via DELETE /rooms/:room

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-28 · updated 2026-10-24
Weakness: CWE-862

Description

Let's Chat 0.3.0 through 0.4.8 contains an improper authorization vulnerability that allows any authenticated user to archive any room on the server by sending a DELETE request to the rooms handler without ownership verification. Attackers can enumerate room IDs via the rooms listing endpoint and permanently archive private or password-protected rooms they cannot access, with no application-level recovery path requiring direct database intervention to restore.

Affected products

sdelements lets-chat: from 0.3.0 through 0.4.8

References

https://github.com/theopaid/Insufficient-Access-Controls-Allow-for-Unauthorized-Room-Deletion-Let-s-Chat-
https://www.vulncheck.com/advisories/let-s-chat-improper-authorization-via-delete-rooms-room

Get alerted when CVE-2026-66751 or the next vulnerability affects your stack