CVE-2026-66751 describes an authorization bypass vulnerability in Let's Chat versions 0.3.0 through 0.4.8. The flaw allows any authenticated user to send a DELETE request to the rooms handler endpoint to archive any room on the server without ownership verification. Attackers can enumerate valid room IDs via the rooms listing endpoint and archive rooms they do not own, including private and password-protected rooms. The archived rooms are permanently removed from the application interface, with no built-in recovery method, necessitating direct database restoration.

An attacker with any authenticated access can permanently archive chat rooms they do not own, including private or password-protected rooms. This results in denial of service for those rooms and potential loss of important chat data. Since recovery requires manual database intervention, the impact includes operational disruption and administrative overhead.

No official patch or fix has been published yet for this vulnerability. Users should monitor vendor advisories for updates. Until a fix is available, restrict authenticated user permissions carefully and consider limiting access to the rooms deletion functionality. Prepare for potential manual recovery by backing up the database regularly.