Vulnerability · Published Jul 28, 2026 · Assigned by VulnCheck

CVE-2026-66750Let's Chat 0.3.0 - 0.4.8 Broken Access Control File Disclosure via GET /files route

Medium 4.3

In plain English

A medium-severity missing authorization in lets-chat from sdelements. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 71.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Public PoC

Official description

Let's Chat 0.3.0 through 0.4.8 contains a broken access control vulnerability that allows authenticated attackers to download file attachments from private and password-protected rooms they are not a member of by exploiting missing room membership checks in the file retrieval route. Attackers can enumerate adjacent MongoDB ObjectIds derived from a known file ID to recover files uploaded by other users, as the GET /files/:id/:name route in app/controllers/files.js only enforces login authentication without consulting room membership or the Room.canJoin check.

Affected products (as reported)

Vendor	Product	Versions
sdelements	lets-chat	0.3.0 – through 0.4.855e8833974c83559ed2cbc12bc15febeb2466254 – through 617207ff3c0c0bf8e3c7a915bd9ec03f1dd8390c

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

Researcher Disclosure technical-description, exploit
https://www.vulncheck.com/advisories/let-s-chat-broken-access-control-file-disclosure-via-get-files-route third-party-advisory