# CVE-2026-66751: sdelements Let's Chat improper authorization in rooms handler

Source: https://junglewise.ai/threats/cve-2026-66751-sdelements-let-s-chat-improper-authorization-in-rooms-handler  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-28. Updated: 2026-07-28  
License: CC BY 4.0 with a link back

CVE-2026-66751 · Severity: medium · CVSS 5.4 · Published 2026-07-28

Let's Chat is a self-hosted chat application for small teams. A security flaw allows any logged-in user to permanently archive any chat room on the server, including private or password-protected rooms they do not belong to. This can lead to significant operational disruption and data loss, as there is no way to restore these rooms through the application interface without manual database intervention.

Technologies: [SD Elements Let's Chat](https://junglewise.ai/threats/technologies/let-s-chat). Vendors: [SD Elements](https://junglewise.ai/threats/vendors/sd-elements).

## Quick answers

**Is CVE-2026-66751 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-66751 being exploited in the wild.

**How severe is CVE-2026-66751?** Medium severity, with a CVSS score of 5.4, published 28 July 2026.

**Which products and versions are affected?** SD Elements Let's Chat 0.3.0 through 0.4.8.

**Is there a fix for CVE-2026-66751?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-66751 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-66751?** Check whether you run SD Elements Let's Chat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An improper authorization vulnerability (CWE-862) exists in Let's Chat versions 0.3.0 through 0.4.8. The application fails to perform ownership or permission verification when a DELETE request is sent to the /rooms/:room endpoint. An authenticated attacker can enumerate room IDs via the rooms listing endpoint and issue unauthorized DELETE requests to archive any room, including those they are not authorized to access. Because the application lacks a built-in recovery mechanism for archived rooms, restoration requires direct manual intervention in the database. The product repository was archived in late 2025, suggesting no official patch is forthcoming.

## Affected products

- sdelements Let's Chat 0.3.0 through 0.4.8

## Timeline

- 2026-07-28: disclosed
- 2026-07-28: advisory

## References

- [https://github.com/theopaid/Insufficient-Access-Controls-Allow-for-Unauthorized-Room-Deletion-Let-s-Chat-](https://github.com/theopaid/Insufficient-Access-Controls-Allow-for-Unauthorized-Room-Deletion-Let-s-Chat-)
- [https://www.vulncheck.com/advisories/let-s-chat-improper-authorization-via-delete-rooms-room](https://www.vulncheck.com/advisories/let-s-chat-improper-authorization-via-delete-rooms-room)

## Related threats

- [sdelements Let's Chat broken access control in file retrieval route](https://junglewise.ai/threats/cve-2026-66750-sdelements-let-s-chat-broken-access-control-in-file-retrieval)