CVE-2026-66751

🗓️ 28 Jul 2026 15:36:15Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 31 Views🌐 WEB

Improper authorization lets any authenticated user archive any room via DELETE /rooms/:room without ownership check, enabling enumeration and permanent loss.

Reporter	Title	Published	Views	Family All 8
ATTACKERKB	CVE-2026-66751	28 Jul 202615:36	–	attackerkb
Cvelist	CVE-2026-66751 Let's Chat 0.3.0 - 0.4.8 Improper Authorization via DELETE /rooms/:room	28 Jul 202615:36	–	cvelist
EUVD	EUVD-2026-49878	28 Jul 202615:36	–	euvd
Kitploit	CVE-2026-66751-Insufficient-Access-Controls-Allow-for-Unauthorized-Room-Deletion-Let-s-Chat-	1 Sep 202614:10	–	kitploit
NVD	CVE-2026-66751	28 Jul 202616:20	–	nvd
Packet Storm	📄 Let's Chat 0.4.8 Missing Authorization	29 Jul 202600:00	–	packetstorm
Positive Technologies	PT-2026-65521	28 Jul 202600:00	–	ptsecurity
Vulnrichment	CVE-2026-66751 Let's Chat 0.3.0 - 0.4.8 Improper Authorization via DELETE /rooms/:room	28 Jul 202615:36	–	vulnrichment

Vulners

Node

sdelements lets-chatRange0.3.0–0.4.8

sdelements lets-chatRange5b5f46f92696955c27864dbca8b33b5b6a39a502–617207ff3c0c0bf8e3c7a915bd9ec03f1dd8390c

[
  {
    "defaultStatus": "affected",
    "vendor": "sdelements",
    "product": "lets-chat",
    "packageURL": "pkg:github/sdelements/lets-chat",
    "repo": "https://github.com/sdelements/lets-chat",
    "versions": [
      {
        "status": "affected",
        "version": "0.3.0",
        "versionType": "semver",
        "lessThanOrEqual": "0.4.8"
      },
      {
        "status": "affected",
        "version": "5b5f46f92696955c27864dbca8b33b5b6a39a502",
        "versionType": "git",
        "lessThanOrEqual": "617207ff3c0c0bf8e3c7a915bd9ec03f1dd8390c"
      }
    ]
  }
]

Source	Link
github	www.github.com/theopaid/Insufficient-Access-Controls-Allow-for-Unauthorized-Room-Deletion-Let-s-Chat-
vulncheck	www.vulncheck.com/advisories/let-s-chat-improper-authorization-via-delete-rooms-room

Parameter	Position	Path	Description	CWE
room	path	/rooms/:room	DELETE /rooms/:room lacks ownership checks; any authenticated user can archive (delete) a room they do not own or have permission to access.	CWE-862
id	path	/rooms/:room	DELETE /rooms/:room lacks ownership checks; any authenticated user can archive (delete) a room they do not own or have permission to access.	CWE-862

30 Jul 2026 16:41Current

5.9Medium risk

Vulners AI Score5.9

CVSS 45.3

CVSS 3.15.4

EPSS0.00213

SSVC

CWE-862