CVE-2026-66751

MediumCVSS 5.4/10Last modified Oct 24, 2026

Description

Let's Chat 0.3.0 through 0.4.8 contains an improper authorization vulnerability that allows any authenticated user to archive any room on the server by sending a DELETE request to the rooms handler without ownership verification. Attackers can enumerate room IDs via the rooms listing endpoint and permanently archive private or password-protected rooms they cannot access, with no application-level recovery path requiring direct database intervention to restore.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
sdelements	lets-chat	>= 0.3.0, <= 0.4.8; >= 5b5f46f92696955c27864dbca8b33b5b6a39a502, <= 617207ff3c0c0bf8e3c7a915bd9ec03f1dd8390c

References

Timeline

Published: Jul 28, 2026
Last modified: Oct 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-667525.4tiny-http through 0.12.0 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize request framing by s CVE-2026-667533.7tiny-http through 0.12.0 contains an HTTP header injection vulnerability that allows attackers to inject carriage return (0x0D) and line fee CVE-2026-667545.9Rouille 0.1.6 through 3.6.2 contains a reachable assertion vulnerability in the Request::remove_prefix function that allows remote unauthent CVE-2026-667557.5Relative Path Traversal in the ISA-Tab parser in Apache Software Foundation Apache Tika from 1.8 through 3.3.1, and 4.0.0-alpha-1, allows an CVE-2026-667569.8Improper Protection of Alternate Path vulnerability in Apache Tika. This issue affects Apache Tika: from 4.0.0-alpha-1 before 4.0.0-beta-1.CVE-2026-667575.5A flaw was found in the file-sgi plugin in GIMP. When processing an RLE-compressed SGI image, the plugin allocates memory for a row table. T CVE-2026-667587.8A flaw was found in the file-fits plugin in GIMP. When processing a FITS image file, the plugin calculates memory allocation sizes using sig CVE-2026-667597.1A flaw was found in the file-icns plugin in GIMP. When applying a decompressed mask during ICNS image processing, the plugin reads from the CVE-2026-66767.8Heap buffer out-of-bounds write vulnerability in Avira Antivirus engine when scanning a malformed POSIX tar archive may allow Local Executio CVE-2026-667606.4SAP Approuter does not correctly validate client certificates in certain callback flows. An attacker with low privileges, holding a certific CVE-2026-667614.3SAP Approuter does not enforce sufficient flow control in certain functionality. An attacker with low privileges could send high volumes of CVE-2026-667637.9SAP BusinessObjects Business Intelligence Platform stores certain sensitive credentials associated with user objects using a hard-coded cryp