---
id: "CVE-2026-123206"
kind: "vulnerability"
aliases: ["CVE-2026-123206"]
title: "EdgeChat: unauthenticated users can download public-channel attachments without login"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["edgechat", "other", "self-hosted"]
not_affected_if: ["no-public-channel-attachments", "version-2.20.3-or-later"]
published_at: "2026-11-05T19:17:20+00:00"
first_seen_at: "2026-11-05T19:40:36+00:00"
updated_at: "2026-11-05T19:43:25+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123206", "first_seen_at": "2026-11-05T19:40:36+00:00"}]
exploit_sources: []
---

# EdgeChat: unauthenticated users can download public-channel attachments without login

EdgeChat before 2.20.3 has a missing authentication check on the GET /files/:key route, because canAccessFile() accepts a null user id. An attacker holding an attachment object key can fetch decrypted attachments from public channels without a session or channel membership.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the EdgeChat version in use; versions before `2.20.3` are affected.
- Review whether GET /files/:key is reachable from the internet.

## Fix

- EdgeChat: upgrade to `2.20.3` or later

## Timeline

- 2026-11-05T19:40:36+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123206

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/edgechat-before-2.20.3-missing-authentication-for-attachment-download-via-get-files-key
- [fix] Patch: github.com https://github.com/aozorae/Edgechat/commit/38cb5cf42d8014ca64624d4f4d565419b2fbeda9

## From the sources

EdgeChat before 2.20.3 contains a missing authentication vulnerability in the GET /files/:key route that allows unauthenticated or banned users to download decrypted public-channel attachments because canAccessFile() accepts a null user id. Attackers holding an attachment object key can omit or supply an invalid token to retrieve plaintext attachments without a session or channel membership.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_