EdgeChat before 2.20.3 Missing Authentication for Attachment Download via GET /files/:key

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

EdgeChat before 2.20.3 contains a missing authentication vulnerability in the GET /files/:key route that allows unauthenticated or banned users to download decrypted public-channel attachments because canAccessFile() accepts a null user id. Attackers holding an attachment object key can omit or supply an invalid token to retrieve plaintext attachments without a session or channel membership.

Etkilenen sürümler1 yazılım

Kaynaklar7 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…ommit/38cb5cf42d8014ca64624d4f4d565419b2fbeda9 Yama
• github.com/aozorae/Edgechat/issues/58 Üçüncü taraf
• vulncheck.com/…tion-for-attachment-download-via-get-files-key Üçüncü taraf
• github.com/…2072f8d655be/worker/src/data/uploaded-files.js Diğer
• hackmd.io/…s-unauthenticated-public-attachment-disclosure Diğer

Kayıt geçmişi

1. 5 Kas 2026 21:16Yayımlandı

İlgili açıklar

• 8,8 CVE-2026-123208noname v1.11.2 through v1.11.6.1 Missing Authentication in Electron Local File Server
• 7,7 CVE-2026-49407OpenHuman: Unauthenticated dictation WebSocket allows arbitrary audio streaming and unbounded memory growth
• 8,4 CVE-2026-49393OpenHuman: Unauthenticated Socket.IO RPC bypass allows invoking protected OpenHuman core controllers without the Bearer token
• 6,2 CVE-2026-49405OpenHuman: Unauthenticated server-sent events endpoint leaks user-facing event data
• 7,3 CVE-2026-121139Rapid7 Metasploit Framework Web Service unauthenticated bootstrap window allows creation of an administrator account without authentication
• 7,3 CVE-2026-123032OpenBMB Internet of Agents WebSocket bağlantı yöneticisinde kimlik doğrulama eksikliği