---
id: CVE-2026-123206
title: >-
  EdgeChat before 2.20.3 Missing Authentication for Attachment Download via GET
  /files/:key
summary: >-
  EdgeChat before 2.20.3 contains a missing authentication vulnerability in the
  GET /files/:key route that allows unauthenticated or banned users to download
  decrypted public-channel attachments because canAccessFile() accepts a null
  user …
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-306
vendor: aozorae
product: EdgeChat
affected:
  - EdgeChat < 2.20.3
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T19:03:28.410669Z'
exploitAvailable: true
published: '2026-11-05'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T19:03:57.588Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-123206'
references:
  - url: 'https://github.com/aozorae/Edgechat/issues/58'
  - url: >-
      https://github.com/aozorae/Edgechat/commit/38cb5cf42d8014ca64624d4f4d565419b2fbeda9
  - url: >-
      https://github.com/aozorae/Edgechat/blob/1288c66997d5e2f9eefc515cf60b2072f8d655be/worker/src/data/uploaded-files.js#L146
  - url: >-
      https://hackmd.io/@hieund/edgechat-files-unauthenticated-public-attachment-disclosure
  - url: >-
      https://www.vulncheck.com/advisories/edgechat-before-2.20.3-missing-authentication-for-attachment-download-via-get-files-key
    label: >-
      VulnCheck Advisory: EdgeChat before 2.20.3 Missing Authentication for
      Attachment Download via GET /files/:key
tags:
  - cve.org
  - exploit-available
ingestedAt: '2026-11-05T22:38:31.498Z'
---

## Overview

EdgeChat before 2.20.3 contains a missing authentication vulnerability in the GET /files/:key route that allows unauthenticated or banned users to download decrypted public-channel attachments because canAccessFile() accepts a null user id. Attackers holding an attachment object key can omit or supply an invalid token to retrieve plaintext attachments without a session or channel membership.

## Affected

- `EdgeChat < 2.20.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.