📄 Let's Chat 0.4.8 Information Disclosure

Let's Chat versions 0.4.8 and earlier contain an information disclosure vulnerability in the file download functionality. Any authenticated user can download attachments from private and password-protected rooms without authorization if they know or can derive the associated file identifier...

📄 Let's Chat 0.4.8 Missing Authorization

Let's Chat versions 0.4.8 and earlier contain a missing authorization vulnerability in the room archive functionality. Any authenticated user can archive delete arbitrary rooms, including private and password-protected rooms they do not own or have permission to access, resulting in unauthorized...

CVE-2026-66749

Let's Chat 0.4.0 through 0.4.8 contains a null dereference vulnerability that allows authenticated attackers to crash the server by supplying a valid 24-character hex string room parameter that matches no document in the database. Attackers can send a crafted GET /messages request causing an...

CVE-2026-66751 Let's Chat 0.3.0 - 0.4.8 Improper Authorization via DELETE /rooms/:room

Let's Chat 0.3.0 through 0.4.8 contains an improper authorization vulnerability that allows any authenticated user to archive any room on the server by sending a DELETE request to the rooms handler without ownership verification. Attackers can enumerate room IDs via the rooms listing endpoint and...

CVE-2026-66749

CVE-2026-66749 affects Let's Chat versions 0.4.0–0.4.8. It describes a null dereference that allows an authenticated attacker to crash the Node.js server by supplying a valid 24-character hex room parameter that does not match any document in the database. A crafted GET /messages request triggers...

CVE-2026-66749 Let's Chat 0.4.0 - 0.4.8 Denial of Service via Null Dereference in Room Lookup

Let's Chat 0.4.0 through 0.4.8 contains a null dereference vulnerability that allows authenticated attackers to crash the server by supplying a valid 24-character hex string room parameter that matches no document in the database. Attackers can send a crafted GET /messages request causing an...

lets-chat-kerberos (>=0.2.0, <=0.4.1), passport-assistant-kerberos (0.0.1) +1 more potentially affected by CVE-2016-1000238 via node-krb5 (0.0.6)

node-krb5 NPM version 0.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on node-krb5 and may be impacted: - lets-chat-kerberos =0.2.0, =0.4.1 - passport-assistant-kerberos 0.0.1 - passport-kerberos 0.0.1 Source cves: CVE-2016-1000238 Source advisory:...