CVE-2026-66750 describes a broken access control vulnerability in Let's Chat versions 0.3.0 through 0.4.8. Authenticated attackers can exploit missing room membership checks in the GET /files/:id/:name route to download file attachments from private and password-protected rooms they are not members of. The route enforces only login authentication but does not verify if the user has permission to access the room or files, allowing enumeration of adjacent MongoDB ObjectIds to retrieve files uploaded by other users.

An authenticated attacker can access and download files from private or password-protected rooms without proper authorization. This leads to unauthorized disclosure of potentially sensitive information shared within those rooms. The vulnerability affects confidentiality but does not indicate impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected versions and consider disabling file sharing or the vulnerable file retrieval endpoint. Monitor for updates from the vendor or project for an official fix.