CVE-2026-66751

MEDIUM

Let's Chat 0.3.0 - 0.4.8 Improper Authorization via DELETE /rooms/:room

Title source: cna

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-66751. PoCs published by theopaid.

AI-analyzed exploit summary Detailed technical analysis of CVE-2026-66751, an insufficient access control vulnerability in Let's Chat where any authenticated user can delete any room via a DELETE request to `/rooms/:room` without proper authorization checks. The writeup includes root cause analysis, patch diffs, and reproduction steps.

Description

Let's Chat 0.3.0 through 0.4.8 contains an improper authorization vulnerability that allows any authenticated user to archive any room on the server by sending a DELETE request to the rooms handler without ownership verification. Attackers can enumerate room IDs via the rooms listing endpoint and permanently archive private or password-protected rooms they cannot access, with no application-level recovery path requiring direct database intervention to restore.

Exploits (1)

github WRITEUP

by theopaid · poc

https://github.com/theopaid/CVE-2026-66751-Insufficient-Access-Controls-Allow-for-Unauthorized-Room-Deletion-Let-s-Chat-

View Code ZIP pw:eip

Detailed technical analysis of CVE-2026-66751, an insufficient access control vulnerability in Let's Chat where any authenticated user can delete any room via a DELETE request to `/rooms/:room` without proper authorization checks. The writeup includes root cause analysis, patch diffs, and reproduction steps.

Classification

Writeup 100%

Attack Type

Auth Bypass

Complexity

Trivial

Reliability

Reliable

Target: Let's Chat versions 0.3.0 through 0.4.8

Auth required

Prerequisites: Valid user account on the Let's Chat instance · Network access to the HTTP port of the target server

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1078 - Valid Accounts

mistral-large-3 · analyzed Jul 29, 2026 Full analysis →

References (2)

Core 2

Core References

Exploit technical-description exploit

Researcher Disclosure

https://github.com/theopaid/Insufficient-Access-Controls-Allow-for-Unauthorized-Room-Deletion-Let-s-Chat-

View Exploit ZIP pw:eip

Third Party Advisory third-party-advisory

https://www.vulncheck.com/advisories/let-s-chat-improper-authorization-via-delete-rooms-room

Scores

CVSS v3 5.4

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-862

Status published

Products (2)

sdelements/lets-chat 0.3.0 - 0.4.8

sdelements/lets-chat 5b5f46f92696955c27864dbca8b33b5b6a39a502 - 617207ff3c0c0bf8e3c7a915bd9ec03f1dd8390c

Published Jul 28, 2026

Tracked Since Jul 28, 2026