CVE-2026-66750 in Lets Chat
Summary
by MITRE • 07/28/2026
Let's Chat 0.3.0 through 0.4.8 contains a broken access control vulnerability that allows authenticated attackers to download file attachments from private and password-protected rooms they are not a member of by exploiting missing room membership checks in the file retrieval route. Attackers can enumerate adjacent MongoDB ObjectIds derived from a known file ID to recover files uploaded by other users, as the GET /files/:id/:name route in app/controllers/files.js only enforces login authentication without consulting room membership or the Room.canJoin check.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/28/2026
This vulnerability exists within the Let's Chat messaging platform version range 0.3.0 through 0.4.8 and represents a critical broken access control flaw that undermines the security of private and password-protected chat rooms. The issue stems from insufficient authorization checks in the file retrieval endpoint, specifically the GET /files/:id/:name route located in app/controllers/files.js. While the application properly requires authentication for accessing this endpoint, it fails to validate whether the authenticated user has legitimate membership rights to the room containing the requested file. This fundamental oversight allows malicious actors who are logged into the system to bypass normal access controls and retrieve sensitive attachments from rooms they do not belong to.
The technical exploitation of this vulnerability involves a sophisticated enumeration process that leverages the structure of MongoDB ObjectIds. Attackers can derive adjacent ObjectIds by analyzing a known file ID, effectively enabling them to discover and access files uploaded by other users within the system. This approach demonstrates a lack of proper access control mechanisms that should validate both user authentication status and room membership relationships before granting file access. The vulnerability directly violates the principle of least privilege and represents a classic case of insufficient authorization checks as categorized under CWE-285. The attack vector is particularly dangerous because it requires minimal privileges beyond simple authentication, making it accessible to anyone with valid login credentials.
The operational impact of this vulnerability extends far beyond simple unauthorized file access, potentially exposing sensitive communications and personal data stored in private rooms. Users who rely on password-protected or private chat rooms for confidential discussions face significant risk of data leakage when their room membership is not properly enforced during file retrieval operations. This weakness undermines the entire security model of the platform, as it allows attackers to systematically enumerate and harvest files from multiple rooms without requiring special privileges or knowledge about room membership structures. The vulnerability creates a persistent backdoor that could be exploited repeatedly by malicious actors to gather intelligence, access proprietary information, or compromise user privacy.
Organizations implementing this messaging platform must immediately address this vulnerability through comprehensive security remediation efforts that include implementing proper room membership validation in the file retrieval controller. The fix should enforce Room.canJoin checks and verify user permissions before allowing file downloads, ensuring that only authorized members of a room can access its attachments. This remediation aligns with ATT&CK technique T1078 for valid accounts and T1566 for credential harvesting, as the vulnerability enables unauthorized access through legitimate authentication mechanisms. Additionally, implementing proper access control logging and monitoring would help detect and prevent exploitation attempts, while adhering to security standards such as NIST SP 800-53 controls for access control and system and information integrity.
The root cause of this vulnerability reflects poor software development practices regarding access control implementation and insufficient security code review processes. The lack of proper authorization validation in the file controller demonstrates a failure to implement defense-in-depth principles that should protect against unauthorized access attempts. Security teams should conduct comprehensive penetration testing to identify similar access control gaps throughout the application, particularly in endpoints that handle user-generated content or sensitive data retrieval operations. This vulnerability serves as a reminder of the critical importance of implementing proper authorization checks, especially when dealing with file and resource access controls in collaborative platforms. The remediation process should include thorough code auditing to ensure all file and content retrieval endpoints properly validate user permissions and room membership status before granting access to protected resources.