Executive brief
Let's Chat is a self-hosted chat application for small teams. A security flaw allows any logged-in user to permanently archive any chat room on the server, including private or password-protected rooms they do not belong to. This can lead to significant operational disruption and data loss, as there is no way to restore these rooms through the application interface without manual database intervention.
Technical details
An improper authorization vulnerability (CWE-862) exists in Let's Chat versions 0.3.0 through 0.4.8. The application fails to perform ownership or permission verification when a DELETE request is sent to the /rooms/:room endpoint. An authenticated attacker can enumerate room IDs via the rooms listing endpoint and issue unauthorized DELETE requests to archive any room, including those they are not authorized to access. Because the application lacks a built-in recovery mechanism for archived rooms, restoration requires direct manual intervention in the database. The product repository was archived in late 2025, suggesting no official patch is forthcoming.
Affected products
- sdelements Let's Chat 0.3.0 through 0.4.8
Timeline
- 2026-07-28: disclosed
- 2026-07-28: advisory