CVE-2026-66751

Name of the Vulnerable Software and Affected Versions Let's Chat versions 0.3.0 through 0.4.8

Description An improper authorization issue allows authenticated users to archive any room on the server. This occurs because the rooms handler does not verify ownership when processing a DELETE request. Attackers can identify room IDs through the rooms listing endpoint to permanently archive private or password-protected rooms they are not authorized to access. Once archived, these rooms cannot be recovered through the application and require direct database intervention to restore.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.