CVE-2026-66750

Name of the Vulnerable Software and Affected Versions Let's Chat versions 0.3.0 through 0.4.8

Description Broken access control allows authenticated attackers to download file attachments from private and password-protected rooms they are not members of. This occurs because the system fails to perform room membership checks during file retrieval. An attacker can enumerate adjacent MongoDB ObjectIds—unique identifiers used by MongoDB to reference documents—derived from a known file ID to recover files uploaded by other users. The issue exists in the GET /files/:id/:name endpoint within app/controllers/files.js, which only verifies login authentication and ignores the Room.canJoin() check.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.