The vulnerability arises from improper handling of session data and lack of access control mechanisms in the chat application. By sequentially executing specific POST requests, an attacker can access, copy, and delete chat histories of other users. This can lead to unauthorized data manipulation, privacy violations, and potential further exploitation.

An attacker identifies a victim's username and chat name. They then send a crafted POST request to access the victim's chat history, followed by another POST request to delete the chat history from the victim's folder and paste it into their own folder. This allows the attacker to view and manipulate the victim's chat history.

Users of the chat application version 20240802 are affected by this vulnerability. Any user can potentially have their chat history accessed, copied, and deleted by an attacker.