CVE-2026-66751 Details

A vulnerability exists in Let's Chat versions 0.3.0 through 0.4.8, allowing authenticated users to archive any room on the server without proper authorization. This is achieved by sending a DELETE request to the rooms handler, as the current implementation lacks ownership verification. Attackers can exploit this by first enumerating room IDs through the rooms listing endpoint, and then archiving private or password-protected rooms they do not have access to. Once a room is archived, it is removed from the room list and direct lookups return a 404 status. The application does not provide a recovery mechanism, leaving room restoration to require direct database intervention.

The vulnerability can be addressed by modifying the room archiving function to include an ownership check, ensuring that only room owners can archive their rooms.