CVE-2026-66750: Let's Chat Auth Bypass Vulnerability

CVE-2026-66750 Overview

CVE-2026-66750 is a broken access control vulnerability in Let's Chat versions 0.3.0 through 0.4.8. The flaw allows authenticated attackers to download file attachments from private and password-protected rooms without holding membership. The GET /files/:id/:name route in app/controllers/files.js enforces only login authentication and omits room membership validation. Attackers exploit this by enumerating adjacent MongoDB ObjectIds derived from a known file ID to retrieve files uploaded by other users. The weakness is categorized under [CWE-862] Missing Authorization.

Critical Impact
Authenticated users can access confidential file attachments from private rooms they do not belong to, resulting in disclosure of sensitive organizational data.

Affected Products

Let's Chat 0.3.0 through 0.4.8
app/controllers/files.js file retrieval route
Deployments relying on room-scoped file confidentiality

Discovery Timeline

2026-07-28 - CVE-2026-66750 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-66750

Vulnerability Analysis

Let's Chat is an open-source, self-hosted messaging application that supports private and password-protected rooms for confidential collaboration. The application stores uploaded file attachments and associates each file with a room through a MongoDB ObjectId reference. The file download endpoint requires authentication but does not verify whether the requesting user belongs to the room owning the file. Any authenticated user can request /files/:id/:name and receive the file contents. Because MongoDB ObjectIds are sequential and time-based, an attacker can predict adjacent identifiers and iterate through them programmatically.

Root Cause

The root cause is missing authorization enforcement in the file retrieval route defined in app/controllers/files.js. The handler validates session authentication but never consults room membership metadata or invokes the existing Room.canJoin check that governs room access elsewhere in the application. This omission breaks the authorization boundary between public, private, and password-protected rooms.

Attack Vector

An attacker authenticates to the Let's Chat instance using any valid low-privilege account. The attacker obtains one legitimate file ID by uploading a file or accessing a public room. The attacker then generates neighboring ObjectId values by manipulating the timestamp and counter components of the known identifier. Each candidate ID is submitted to GET /files/:id/:name, and the server returns file contents regardless of the requesting user's room membership. See the VulnCheck Advisory and the GitHub PoC Repository for technical details.

Detection Methods for CVE-2026-66750

Indicators of Compromise

Repeated GET /files/:id/:name requests from a single authenticated session targeting sequentially varying ObjectId values.
Access log entries showing file downloads by users who have no membership record for the associated room.
Bursts of 404 responses from /files/ interleaved with successful 200 responses, indicating ID enumeration.

Detection Strategies

Correlate file download events with room membership tables and alert when the requesting user is absent from the room's participant list.
Baseline the normal rate of file downloads per user session and flag deviations that suggest automated enumeration.
Ingest Let's Chat application logs into a SIEM and build queries that join file access events with the room ownership schema.

Monitoring Recommendations

Enable verbose HTTP access logging on the Let's Chat reverse proxy to capture request paths and response codes.
Monitor outbound data volume from the Let's Chat host for spikes that indicate bulk file exfiltration.
Track authentication events and pair them with subsequent /files/ request patterns to identify reconnaissance behavior.

How to Mitigate CVE-2026-66750

Immediate Actions Required

Restrict network access to the Let's Chat instance to trusted users while a fix is applied.
Audit existing file uploads in private and password-protected rooms and rotate or remove sensitive attachments if disclosure is suspected.
Review authentication logs for accounts performing unusual volumes of file requests and disable suspicious accounts.

Patch Information

No official vendor patch is referenced in the NVD entry at the time of publication. Administrators should track the VulnCheck Advisory for remediation updates and apply an upstream fix that inserts a Room.canJoin check into the file retrieval handler.

Workarounds

Modify app/controllers/files.js locally to look up the file's owning room and invoke the existing Room.canJoin check before returning file contents.
Place the Let's Chat file endpoint behind a reverse proxy rule that requires an additional access token tied to room membership.
Disable file uploads in private and password-protected rooms until a proper authorization check is deployed.

bash

# Configuration example: block direct /files/ access at the reverse proxy
# and require an authenticated internal route with membership validation
location /files/ {
    deny all;
    return 403;
}