CVE-2026-66751 — Let's Chat 0.3.0 - 0.4.8 Improper Authorization via DELETE /rooms/:room
Let's Chat 0.3.0 through 0.4.8 contains an improper authorization vulnerability that allows any authenticated user to archive any room on the server by sending a DELETE request …
Published: 2026-07-28 · CVSS: 5.3 · CVSS 4.0
Let's Chat 0.3.0 through 0.4.8 contains an improper authorization vulnerability that allows any authenticated user to archive any room on the server by sending a DELETE request to the rooms handler without ownership verification. Attackers can enumerate room IDs via the rooms listing endpoint and permanently archive private or password-protected rooms they cannot access, with no application-level recovery path requiring direct database intervention to restore.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7