CVE-2026-82906

LOW 3.7

sdcb chats Signed File Download Endpoint FileController.cs DownloadPublic missing authentication

CVSS Score

3.7

EPSS Score

0.0%

EPSS Percentile

0th

A flaw has been found in sdcb chats up to 1.12.0. This impacts the function DownloadPublic of the file src/BE/web/Controllers/Chats/Files/FileController.cs of the component Signed File Download Endpoint. This manipulation causes missing authentication. Remote exploitation of the attack is possible. The attack's complexity is rated as high. The exploitability is said to be difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CWE	CWE-306 CWE-287
Vendor	sdcb
Product	chats
Published	Aug 31, 2026

Stay Ahead of the Next One

Get instant alerts for sdcb chats

Be the first to know when new low vulnerabilities affecting sdcb chats are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

sdcb / chats

1.0 1.1 1.2 1.3 1.4 1.5 1.6 1.7 1.8 1.9 1.10 1.11 1.12.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/397286 vuldb.com: https://vuldb.com/vuln/397286/cti vuldb.com: https://vuldb.com/cve/CVE-2026-82906 vuldb.com: https://vuldb.com/submit/877767 github.com: https://github.com/yaowenxiao721/Poc/blob/main/sdcb-chats/chats-poc-2.md

Credits

🔍 yaowenxiao (VulDB User) VulDB CNA Team