No VulnCrest analysis published for this CVE yet. Below is the original CNA/NVD description, unmodified.
Description
EdgeChat before 2.20.3 contains a missing authentication vulnerability in the GET /files/:key route that allows unauthenticated or banned users to download decrypted public-channel attachments because canAccessFile() accepts a null user id. Attackers holding an attachment object key can omit or supply an invalid token to retrieve plaintext attachments without a session or channel membership.
Exploits & detection
No public PoC or detection template found yet.
Timeline
- Published: 05 Nov 2026
- Last modified upstream: 05 Nov 2026
Sources & licenses
- CVE / CVSS / CWE
- NVD record ↗ (unmodified). This product uses the NVD API but is not endorsed or certified by the NVD. CVE® © The MITRE Corporation.
- Exploitation
- CISA KEV (CC0) · EPSS by FIRST.org
- References used for the analysis
- https://github.com/aozorae/Edgechat/blob/1288c66997d5e2f9eefc515cf60b2072f8d655be/worker/src/data/uploaded-files.js#L146
- https://github.com/aozorae/Edgechat/commit/38cb5cf42d8014ca64624d4f4d565419b2fbeda9
- https://github.com/aozorae/Edgechat/issues/58
- https://hackmd.io/@hieund/edgechat-files-unauthenticated-public-attachment-disclosure
- https://www.vulncheck.com/advisories/edgechat-before-2.20.3-missing-authentication-for-attachment-download-via-get-files-key
- https://hackmd.io/@hieund/edgechat-files-unauthenticated-public-attachment-disclosure
- Analysis, summary and remediation
- © VulnCrest