Improper Authorization in Let's Chat Allowing Room Archiving

Executive Summary

CVE-2026-66751 is an improper authorization vulnerability in Let's Chat versions 0.3.0 through 0.4.8. It allows any authenticated user to archive any room on the server by sending a DELETE request without verifying ownership. Attackers can enumerate room IDs via the rooms listing endpoint and permanently archive private or password-protected rooms they cannot access. Recovery requires direct database intervention.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for unauthorized DELETE requests to the /rooms/:room endpoint by authenticated users. Check server logs for DELETE requests targeting room IDs that the user does not own. Verify if archived rooms appear in room listings or if direct lookups return 404 errors unexpectedly.

Useful 0 Not Useful 0

Impact Analysis

If you use Let's Chat versions 0.3.0 to 0.4.8, an attacker with a valid account could delete any room, including private or password-protected ones, causing permanent data loss. Rooms become inaccessible, messages and files are lost, and normal operations are disrupted. No application-level recovery is available.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA by enabling unauthorized deletion of sensitive data. Permanent loss of private rooms may violate data retention and protection requirements. Organizations may face penalties for failing to protect user data adequately.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the Let's Chat application to a patched version if available. If no patch exists, restrict DELETE /rooms/:room endpoint access to room owners only by implementing ownership verification. Temporarily disable the DELETE endpoint if possible or add rate limiting to reduce attack surface.

Useful 0 Not Useful 0