The vulnerability in Let's Chat releases 0.3.0 through 0.4.8 allows a logged‑in user to send a DELETE request to any room ID without verifying that the user owns the room. As a result, the attacker can permanently archive private or password‑protected rooms, effectively creating a loss of data and availability for those spaces. The application provides no recovery pathway except manual database intervention, making the effect irreversible through normal UI operations.

The affected platform is the Let's Chat application released by sdelements, version numbers ranging from 0.3.0 to 0.4.8. Any installation of these releases is subject to the described error in room deletion authorization.

The CVSS score of 5.3 indicates a moderate severity, and the EPSS score below 1% suggests a very low likelihood of widespread exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. Attackers must first authenticate to the system; once authenticated, the lack of ownership checks allows arbitrary room archival. No elevated privileges or remote code execution are required, so the exploit path is entirely through normal application operations. The risk is most acute in environments where many users have access to the system and room data is critical.