CVE-2026-123206— EdgeChat before 2.20.3 Missing Authentication for Attachment Download via GET /files/:key

Quick assessment

Affected

aozorae EdgeChat

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

EdgeChat 2.20.3 之前的版本在路由中存在一个缺少身份验证的漏洞。该漏洞允许未认证用户或被封禁用户下载已解密的公共频道附件，原因是函数会接受用户 ID。攻击者若持有附件对象的密钥，即可省略或提供无效令牌，从而无需会话或频道成员身份即可获取明文附件。

CVSS 3.7 · Low Updated Nov 06, 2026

Possible ATT&CK Techniques 2 AI

T1560 · Archive Collected Data T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
aozorae	EdgeChat	`< 2.20.3`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

EdgeChat before 2.20.3 Missing Authentication for Attachment Download via GET /files/:key

Source: CVE Program / CVE List V5

Vulnerability Description

EdgeChat before 2.20.3 contains a missing authentication vulnerability in the GET /files/:key route that allows unauthenticated or banned users to download decrypted public-channel attachments because canAccessFile() accepts a null user id. Attackers holding an attachment object key can omit or supply an invalid token to retrieve plaintext attachments without a session or channel membership.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

关键功能的认证机制缺失

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
aozorae	EdgeChat	0 ~ 2.20.3	-

II. Public POCs for CVE-2026-123206

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-123206

请登录查看更多情报信息。

Other References for CVE-2026-123206 (5)

https://github.com/aozorae/Edgechat/blob/1288c66997d5e2f9eefc515cf60b2072f8d655be/worker/src/data/uploaded-files.js#L146 technical-description
https://github.com/aozorae/Edgechat/commit/38cb5cf42d8014ca64624d4f4d565419b2fbeda9 patch
https://github.com/aozorae/Edgechat/issues/58 issue-tracking
https://hackmd.io/@hieund/edgechat-files-unauthenticated-public-attachment-disclosure technical-description
https://www.vulncheck.com/advisories/edgechat-before-2.20.3-missing-authentication-for-attachment-download-via-get-files-key third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-123206

IV. Related Vulnerabilities

Same weakness: CWE-306