CVE-2026-123206 EdgeChat before 2.20.3 Missing Authentication for Attachment Download via GET /files/:key

EdgeChat before 2.20.3 contains a missing authentication vulnerability in the GET /files/:key route that allows unauthenticated or banned users to download decrypted public-channel attachments because canAccessFile accepts a null user id. Attackers holding an attachment object key can omit or...

EUVD-2026-117651

EdgeChat before 2.20.3 contains a missing authentication vulnerability in the GET /files/:key route that allows unauthenticated or banned users to download decrypted public-channel attachments because canAccessFile accepts a null user id. Attackers holding an attachment object key can omit or...

CVE-2026-123206

EdgeChat versions prior to 2.20.3 are vulnerable to a missing authentication flaw in the GET /files/:key route. The vulnerability exists because the canAccessFile() function incorrectly accepts a null user id , allowing unauthenticated or banned users to download decrypted public-channel attachme...