Missing Authentication Flaw in EdgeChat Affects Attachment Security

CVE-2026-123206

What is CVE-2026-123206?

EdgeChat versions below 2.20.3 are affected by a missing authentication vulnerability in the GET /files/:key route, allowing unauthorized access to decrypted public-channel attachments. This occurs because the canAccessFile() function accepts a null user ID, enabling attackers to exploit this flaw. By providing a valid or invalid token, malicious users can retrieve plaintext attachments without requiring a valid session or membership in the channel, compromising the security of sensitive files.

References