CVE-2026-123206 EdgeChat before 2.20.3 Missing Authentication for Attachment Download via GET /files/:key

EdgeChat before 2.20.3 contains a missing authentication vulnerability in the GET /files/:key route that allows unauthenticated or banned users to download decrypted public-channel attachments because canAccessFile accepts a null user id. Attackers holding an attachment object key can omit or...