CVE-2026-123206 · Other
NO FIX YET · SEE WHAT TO DO
EdgeChat before 2.20.3 has a missing authentication check on the GET /files/:key route, because canAccessFile() accepts a null user id. An attacker holding an attachment object key can fetch decrypted attachments from public channels without a session or channel membership.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running self-hosted EdgeChat before 2.20.3 with public channels that carry attachments. Exposure depends on attachment object keys being obtainable by an attacker; deployments on newer versions are not affected.
Not affected if no-public-channel-attachments, version-2.20.3-or-later
Who cares edgechat, self-hosted
2.20.3 are affected.2.20.3 or laterEdgeChat before 2.20.3 contains a missing authentication vulnerability in the GET /files/:key route that allows unauthenticated or banned users to download decrypted public-channel attachments because canAccessFile() accepts a null user id. Attackers holding an attachment object key can omit or supply an invalid token to retrieve plaintext attachments without a session or channel membership.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.