CVE-2026-66750 Details

A broken access control vulnerability has been identified in Let's Chat versions 0.3.0 through 0.4.8. This vulnerability allows authenticated attackers to download file attachments from private and password-protected rooms they do not belong to. The issue arises from missing room membership checks in the file retrieval process. Attackers can exploit this by using known file IDs to access files uploaded by other users, as the GET /files/:id/:name route only verifies login status without considering room membership or the Room.canJoin validation.

It is recommended to modify the file download route to include room membership checks, similar to those already implemented in the file listing endpoint. This can be done by loading the room associated with the file and using the Room.canJoin method to verify access before allowing the download.