Executive brief
Let's Chat is a self-hosted chat application for small teams. A security flaw allows any logged-in user to download private file attachments from chat rooms they are not supposed to have access to, including password-protected or private rooms. This could lead to the unauthorized exposure of sensitive company documents or private communications shared within the platform.
Technical details
A broken access control vulnerability exists in the file retrieval logic of Let's Chat versions 0.3.0 through 0.4.8. The GET /files/:id/:name route in app/controllers/files.js verifies that a user is authenticated but fails to perform authorization checks regarding room membership or the Room.canJoin status. An attacker can exploit this by predicting or enumerating MongoDB ObjectIds for files to download attachments from rooms they have not joined. This allows for unauthorized data disclosure across the entire application instance. The project was archived in late 2025, and no official patch is currently noted.
Affected products
- sdelements Let's Chat 0.3.0 - 0.4.8
Timeline
- 2026-07-28: disclosed
- 2026-07-28: advisory