EUVD-2026-117651

EdgeChat before 2.20.3 contains a missing authentication vulnerability in the GET /files/:key route that allows unauthenticated or banned users to download decrypted public-channel attachments because canAccessFile accepts a null user id. Attackers holding an attachment object key can omit or...