CVE-2026-66751: Let's Chat Auth Bypass Vulnerability

CVE-2026-66751 Overview

CVE-2026-66751 is an improper authorization vulnerability affecting Let's Chat versions 0.3.0 through 0.4.8. The application fails to verify room ownership before processing archive requests through the rooms handler. Any authenticated user can send a DELETE request to archive any room on the server, including private or password-protected rooms they cannot access. Attackers enumerate room identifiers via the public rooms listing endpoint before issuing the archive request. The vulnerability is classified under CWE-862: Missing Authorization.

Critical Impact
Archived rooms have no application-level recovery path and require direct database intervention to restore, resulting in persistent loss of collaboration data.

Affected Products

Let's Chat 0.3.0
Let's Chat versions 0.3.x through 0.4.7
Let's Chat 0.4.8

Discovery Timeline

2026-07-28 - CVE-2026-66751 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-66751

Vulnerability Analysis

Let's Chat exposes a rooms handler that accepts DELETE requests to archive chat rooms. The handler processes the request based on authentication alone, without validating whether the requesting user owns the target room. Any authenticated account can therefore archive rooms belonging to other users, including private rooms and password-protected rooms the attacker has never joined.

The rooms listing endpoint returns room metadata including internal identifiers. Attackers combine these two behaviors: enumerate room IDs through the listing endpoint, then issue DELETE requests against the rooms handler using those IDs. The impact extends beyond a transient denial of service because Let's Chat provides no in-application restoration path. Administrators must intervene at the MongoDB layer to reverse the archived state, making recovery operationally expensive.

Root Cause

The root cause is a missing authorization check in the DELETE rooms route handler. The code path validates session authentication but omits a comparison between the requesting user and the room's owner or membership set. This maps directly to CWE-862 (Missing Authorization).

Attack Vector

Exploitation requires network access to the Let's Chat instance and a valid low-privileged account. An attacker authenticates, calls the rooms listing endpoint to harvest room IDs, and then sends a DELETE request to the rooms handler for each targeted room. No user interaction is required, and the operation completes with a single HTTP request per room. See the VulnCheck Security Advisory and the GitHub PoC Repository for a working proof of concept.

Detection Methods for CVE-2026-66751

Indicators of Compromise

HTTP DELETE requests to the /rooms/:room endpoint originating from accounts that are not the room owner.
Sequential enumeration of room identifiers via GET requests to /rooms followed by DELETE requests to the same IDs from one session.
Sudden spikes in archived rooms across unrelated owners within a short time window.

Detection Strategies

Instrument the Let's Chat reverse proxy or application logs to alert on DELETE requests where the authenticated user ID does not match the room owner ID.
Correlate rooms listing traffic with subsequent DELETE traffic from the same session to identify enumeration patterns.
Baseline normal archive activity per user and flag deviations exceeding the baseline threshold.

Monitoring Recommendations

Forward web server access logs and MongoDB audit logs into a centralized analytics platform for cross-source correlation.
Track the rooms.archived field state changes in MongoDB and alert when the modifying account differs from the room owner.
Monitor authentication logs for newly created accounts followed immediately by DELETE activity against the rooms endpoint.

How to Mitigate CVE-2026-66751

Immediate Actions Required

Restrict network access to the Let's Chat instance to trusted users while remediation is pending.
Audit the rooms collection for unexpected archived: true documents and restore legitimate rooms via direct database update.
Revoke or rotate credentials for accounts that show enumeration or unauthorized DELETE activity.

Patch Information

No vendor-supplied patch is referenced in the current advisory data. Administrators should apply the authorization check as a source-level fix by verifying that the requesting user is the room owner before executing the archive operation in the DELETE rooms route handler. Track the VulnCheck Security Advisory for upstream fix availability.

Workarounds

Place Let's Chat behind a reverse proxy that blocks DELETE requests to /rooms/:room for non-administrative accounts.
Apply a local source patch that compares req.user._id to room.owner before archiving and returns HTTP 403 on mismatch.
Disable self-service account registration to limit the pool of authenticated users capable of triggering the vulnerability.

bash

# Example reverse proxy rule (nginx) restricting DELETE to admin subnet
location ~ ^/rooms/[^/]+$ {
    limit_except GET POST {
        allow 10.0.0.0/24;   # admin management subnet
        deny  all;
    }
    proxy_pass http://letschat_upstream;
}