CVE-2026-123206 EdgeChat before 2.20.3 Missing Authentication for Attachment Download via GET /files/:key

Medium 6.3 Published 5 Nov 2026 Updated 5 Nov 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-123206?

CVE-2026-123206 is a medium-severity vulnerability in aozorae EdgeChat, published on 5 Nov 2026.

Official description

EdgeChat before 2.20.3 contains a missing authentication vulnerability in the GET /files/:key route that allows unauthenticated or banned users to download decrypted public-channel attachments because canAccessFile() accepts a null user id. Attackers holding an attachment object key can omit or supply an invalid token to retrieve plaintext attachments without a session or channel membership.

Weakness: CWE-306

Which versions are affected by CVE-2026-123206?

How do I fix CVE-2026-123206?

No fix has been published for CVE-2026-123206 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-123206 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-123206 exists.

Sources

Also known as GHSA-24j8-6f8g-7442.