Description
Let's Chat 0.3.0 through 0.4.8 contains an improper authorization vulnerability that allows any authenticated user to archive any room on the server by sending a DELETE request to the rooms handler without ownership verification. Attackers can enumerate room IDs via the rooms listing endpoint and permanently archive private or password-protected rooms they cannot access, with no application-level recovery path requiring direct database intervention to restore.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| sdelements | lets-chat | 0.3.0 – ≤ 0.4.8 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
theopaid/CVE-2026-66751-Insufficient-Access-Controls-Allow-for-Unauthorized-Room-Deletion-Let-s-Chat- ★ 0 · Jul 26, 2026
Security Advisory: Insufficient Access Controls Allow for Unauthorized Room Deletion (Let's Chat)
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- Researcher Disclosure technical-description exploit
- https://www.vulncheck.com/advisories/let-s-chat-improper-authorization-via-delete-rooms-room third-party-advisory