Let's Chat versions 0.3.0 through 0.4.8 exhibit a broken access control flaw that lets an authenticated user retrieve attachments from rooms they do not belong to. The vulnerability arises because the GET /files/:id/:name route performs only a generic login check and does not enforce membership or evaluate the Room.canJoin logic. As a result, a malicious actor can pull private or password‑protected files and even enumerate adjacent MongoDB ObjectIds to discover additional files owned by other users. The flaw enables the disclosure of potentially sensitive or proprietary content, directly compromising data confidentiality for users of the application.

The affected product is Lets Chat by sdelements, versions 0.3.0 through 0.4.8. No other vendors or product variants are listed in the CNA data.

The CVSS score of 5.3 places the issue in the medium severity range, but the EPSS score of less than 1 % indicates a very low real‑world exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector can be inferred to be a credential‑based threat where a logged‑in user with arbitrary or compromised credentials is able to download files from any room. The vulnerability requires no special privileges beyond standard authentication and therefore can be exploited as long as the attacker has any user account, even if it belongs to a benign role.