CVE-2026-123206
3.7 LOWpublic exploit availablePublished 2026-11-05 · Updated 2026-11-05
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
EdgeChat before 2.20.3 contains a missing authentication vulnerability in the GET /files/:key route that allows unauthenticated or banned users to download decrypted public-channel attachments because canAccessFile() accepts a null user id. Attackers holding an attachment object key can omit or supply an invalid token to retrieve plaintext attachments without a session or channel membership.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-306
Public exploit & PoC references
All references
- https://github.com/aozorae/Edgechat/blob/1288c66997d5e2f9eefc515cf60b2072f8d655be/worker/src/data/uploaded-files.js#L146
- https://github.com/aozorae/Edgechat/commit/38cb5cf42d8014ca64624d4f4d565419b2fbeda9
- https://github.com/aozorae/Edgechat/issues/58
- https://hackmd.io/@hieund/edgechat-files-unauthenticated-public-attachment-disclosure
- https://www.vulncheck.com/advisories/edgechat-before-2.20.3-missing-authentication-for-attachment-download-via-get-files-key
- https://hackmd.io/@hieund/edgechat-files-unauthenticated-public-attachment-disclosure
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- CRITICALCVE-2022-29966PoC
- MEDIUMCVE-2024-5563
- UNSCOREDCVE-2025-30043
- UNSCOREDCVE-2025-30053
- CRITICALCVE-2025-70516
- MEDIUMCVE-2026-100192PoC
- UNSCOREDCVE-2026-100406PoC
- HIGHCVE-2026-100672PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.