CVE-2026-66750

Let's Chat 0.3.0 through 0.4.8 contains a broken access control vulnerability that allows authenticated attackers to download file attachments from private and password-protected rooms they are not a member of by exploiting missing room membership checks in the file retrieval route. Attackers can enumerate adjacent MongoDB ObjectIds derived from a known file ID to recover files uploaded by other users, as the GET /files/:id/:name route in app/controllers/files.js only enforces login authentication without consulting room membership or the Room.canJoin check.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/theopaid/Insufficient-Access-Controls-Allow-for-Unauthorized-File-Downloads-Let-s-Chat-
https://www.vulncheck.com/advisories/let-s-chat-broken-access-control-file-disclosure-via-get-files-route

Configurations

No configuration.

History

24 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) Let’s Chat 0.3.0 a 0.4.8 contiene una vulnerabilidad de control de acceso roto que permite a atacantes autenticados descargar archivos adjuntos de salas privadas y protegidas con contraseña de las que no son miembros, explotando la falta de comprobaciones de membresía de sala en la ruta de recuperación de archivos. Los atacantes pueden enumerar ObjectIds de MongoDB adyacentes derivados de un ID de archivo conocido para recuperar archivos subidos por otros usuarios, ya que la ruta GET /files/:id/:name en app/controllers/files.js solo aplica la autenticación de inicio de sesión sin consultar la membresía de la sala o la comprobación Room.canJoin.

Information

Published : 2026-07-28 16:20

Updated : 2026-10-24 13:10

NVD link : CVE-2026-66750

Mitre link : CVE-2026-66750

CVE.ORG link : CVE-2026-66750

JSON object : View

Products Affected

No product.

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-66750", "cveTags": [{"tags": ["unsupported-when-assigned"], "sourceIdentifier": "disclosure@vulncheck.com"}], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-66750", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-28T17:06:35.848454Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/sdelements/lets-chat", "vendor": "sdelements", "product": "lets-chat", "versions": [{"status": "affected", "version": "0.3.0", "versionType": "semver", "lessThanOrEqual": "0.4.8"}, {"status": "affected", "version": "55e8833974c83559ed2cbc12bc15febeb2466254", "versionType": "git", "lessThanOrEqual": "617207ff3c0c0bf8e3c7a915bd9ec03f1dd8390c"}], "packageURL": "pkg:github/sdelements/lets-chat", "defaultStatus": "affected"}]}], "published": "2026-07-28T16:20:16.603", "references": [{"url": "https://github.com/theopaid/Insufficient-Access-Controls-Allow-for-Unauthorized-File-Downloads-Let-s-Chat-", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/let-s-chat-broken-access-control-file-disclosure-via-get-files-route", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Let's Chat 0.3.0 through 0.4.8 contains a broken access control vulnerability that allows authenticated attackers to download file attachments from private and password-protected rooms they are not a member of by exploiting missing room membership checks in the file retrieval route. Attackers can enumerate adjacent MongoDB ObjectIds derived from a known file ID to recover files uploaded by other users, as the GET /files/:id/:name route in app/controllers/files.js only enforces login authentication without consulting room membership or the Room.canJoin check."}, {"lang": "es", "value": "Let\u2019s Chat 0.3.0 a 0.4.8 contiene una vulnerabilidad de control de acceso roto que permite a atacantes autenticados descargar archivos adjuntos de salas privadas y protegidas con contrase\u00f1a de las que no son miembros, explotando la falta de comprobaciones de membres\u00eda de sala en la ruta de recuperaci\u00f3n de archivos. Los atacantes pueden enumerar ObjectIds de MongoDB adyacentes derivados de un ID de archivo conocido para recuperar archivos subidos por otros usuarios, ya que la ruta GET /files/:id/:name en app/controllers/files.js solo aplica la autenticaci\u00f3n de inicio de sesi\u00f3n sin consultar la membres\u00eda de la sala o la comprobaci\u00f3n Room.canJoin."}], "lastModified": "2026-10-24T13:10:00.147", "sourceIdentifier": "disclosure@vulncheck.com"}