CVE-2026-123206
EdgeChat before 2.20.3 Missing Authentication for Attachment Download via GET /files/:key
CVSS Score
3.7
EPSS Score
0.0%
EPSS Percentile
0th
EdgeChat before 2.20.3 contains a missing authentication vulnerability in the GET /files/:key route that allows unauthenticated or banned users to download decrypted public-channel attachments because canAccessFile() accepts a null user id. Attackers holding an attachment object key can omit or supply an invalid token to retrieve plaintext attachments without a session or channel membership.
| CWE | CWE-306 |
| Vendor | aozorae |
| Product | edgechat |
| Published | Nov 5, 2026 |
| Last Updated | Nov 5, 2026 |
Stay Ahead of the Next One
Get instant alerts for aozorae edgechat
Be the first to know when new low vulnerabilities affecting aozorae edgechat are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Affected Versions
aozorae / EdgeChat
0 < 2.20.3
References
github.com: https://github.com/aozorae/Edgechat/issues/58 github.com: https://github.com/aozorae/Edgechat/commit/38cb5cf42d8014ca64624d4f4d565419b2fbeda9 github.com: https://github.com/aozorae/Edgechat/blob/1288c66997d5e2f9eefc515cf60b2072f8d655be/worker/src/data/uploaded-files.js#L146 hackmd.io: https://hackmd.io/@hieund/edgechat-files-unauthenticated-public-attachment-disclosure vulncheck.com: https://www.vulncheck.com/advisories/edgechat-before-2.20.3-missing-authentication-for-attachment-download-via-get-files-key
Credits
hieuPenguinnn aozorae