CVE-2026-66751

EUVD-2026-49878 MEDIUM

Missing Authorization (CWE-862)

2026-07-28 disclosure@vulncheck.com

GHSA-r5q3-g4qh-p8mp

Authentication Bypass

5.3

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (vulncheck) · only source for this CVE.

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 28, 2026 - 16:41 vuln.today

DescriptionCVE.org

Let's Chat 0.3.0 through 0.4.8 contains an improper authorization vulnerability that allows any authenticated user to archive any room on the server by sending a DELETE request to the rooms handler without ownership verification. Attackers can enumerate room IDs via the rooms listing endpoint and permanently archive private or password-protected rooms they cannot access, with no application-level recovery path requiring direct database intervention to restore.

AnalysisAI

Archive of any chat room without authorization in Let's Chat 0.3.0–0.4.8 allows any authenticated user to permanently remove private or password-protected rooms by sending DELETE requests. Room IDs can be enumerated via the rooms listing endpoint, and recovery requires direct database manipulation. A proof-of-concept exploit exists.