CVE-2026-123206

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-123206", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-11-05T17:58:51.927Z", "datePublished": "2026-11-05T18:16:41.120Z", "dateUpdated": "2026-11-05T19:03:57.588Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-05T18:16:41.120Z"}, "datePublic": "2026-11-05T00:00:00.000Z", "title": "EdgeChat before 2.20.3 Missing Authentication for Attachment Download via GET /files/:key", "descriptions": [{"lang": "en", "value": "EdgeChat before 2.20.3 contains a missing authentication vulnerability in the GET /files/:key route that allows unauthenticated or banned users to download decrypted public-channel attachments because canAccessFile() accepts a null user id. Attackers holding an attachment object key can omit or supply an invalid token to retrieve plaintext attachments without a session or channel membership."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Missing Authentication for Critical Function", "cweId": "CWE-306", "type": "CWE"}]}], "affected": [{"vendor": "aozorae", "product": "EdgeChat", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "2.20.3", "status": "affected", "versionType": "semver"}], "packageURL": "pkg:github/aozorae/edgechat", "repo": "https://github.com/aozorae/Edgechat"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW"}}], "references": [{"url": "https://github.com/aozorae/Edgechat/issues/58", "tags": ["issue-tracking"]}, {"url": "https://github.com/aozorae/Edgechat/commit/38cb5cf42d8014ca64624d4f4d565419b2fbeda9", "tags": ["patch"]}, {"url": "https://github.com/aozorae/Edgechat/blob/1288c66997d5e2f9eefc515cf60b2072f8d655be/worker/src/data/uploaded-files.js#L146", "tags": ["technical-description"]}, {"url": "https://hackmd.io/@hieund/edgechat-files-unauthenticated-public-attachment-disclosure", "tags": ["technical-description"]}, {"name": "VulnCheck Advisory: EdgeChat before 2.20.3 Missing Authentication for Attachment Download via GET /files/:key", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/edgechat-before-2.20.3-missing-authentication-for-attachment-download-via-get-files-key"}], "credits": [{"lang": "en", "value": "hieuPenguinnn", "type": "finder"}, {"lang": "en", "value": "aozorae", "type": "remediation developer"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"references": [{"url": "https://hackmd.io/@hieund/edgechat-files-unauthenticated-public-attachment-disclosure", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-05T19:03:28.410669Z", "id": "CVE-2026-123206", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T19:03:57.588Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-123206", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T19:03:28.410669Z"}}}], "references": [{"url": "https://hackmd.io/@hieund/edgechat-files-unauthenticated-public-attachment-disclosure", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T19:03:46.439Z"}}], "cna": {"title": "EdgeChat before 2.20.3 Missing Authentication for Attachment Download via GET /files/:key", "credits": [{"lang": "en", "type": "finder", "value": "hieuPenguinnn"}, {"lang": "en", "type": "remediation developer", "value": "aozorae"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"repo": "https://github.com/aozorae/Edgechat", "vendor": "aozorae", "product": "EdgeChat", "versions": [{"status": "affected", "version": "0", "lessThan": "2.20.3", "versionType": "semver"}], "packageURL": "pkg:github/aozorae/edgechat", "defaultStatus": "unaffected"}], "datePublic": "2026-11-05T00:00:00.000Z", "references": [{"url": "https://github.com/aozorae/Edgechat/issues/58", "tags": ["issue-tracking"]}, {"url": "https://github.com/aozorae/Edgechat/commit/38cb5cf42d8014ca64624d4f4d565419b2fbeda9", "tags": ["patch"]}, {"url": "https://github.com/aozorae/Edgechat/blob/1288c66997d5e2f9eefc515cf60b2072f8d655be/worker/src/data/uploaded-files.js#L146", "tags": ["technical-description"]}, {"url": "https://hackmd.io/@hieund/edgechat-files-unauthenticated-public-attachment-disclosure", "tags": ["technical-description"]}, {"url": "https://www.vulncheck.com/advisories/edgechat-before-2.20.3-missing-authentication-for-attachment-download-via-get-files-key", "name": "VulnCheck Advisory: EdgeChat before 2.20.3 Missing Authentication for Attachment Download via GET /files/:key", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "EdgeChat before 2.20.3 contains a missing authentication vulnerability in the GET /files/:key route that allows unauthenticated or banned users to download decrypted public-channel attachments because canAccessFile() accepts a null user id. Attackers holding an attachment object key can omit or supply an invalid token to retrieve plaintext attachments without a session or channel membership."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "Missing Authentication for Critical Function"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-05T18:16:41.120Z"}}}, "cveMetadata": {"cveId": "CVE-2026-123206", "state": "PUBLISHED", "dateUpdated": "2026-11-05T19:03:57.588Z", "dateReserved": "2026-11-05T17:58:51.927Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-11-05T18:16:41.120Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:github/aozorae/edgechat", "product": "EdgeChat", "repo": "https://github.com/aozorae/Edgechat", "vendor": "aozorae", "versions": [{"lessThan": "2.20.3", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "EdgeChat before 2.20.3 contains a missing authentication vulnerability in the GET /files/:key route that allows unauthenticated or banned users to download decrypted public-channel attachments because canAccessFile() accepts a null user id. Attackers holding an attachment object key can omit or supply an invalid token to retrieve plaintext attachments without a session or channel membership."}], "id": "CVE-2026-123206", "lastModified": "2026-11-12T21:36:06.743", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 1.4, "source": "disclosure@vulncheck.com", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-123206", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T19:03:28.410669Z", "version": "2.0.3"}}]}, "published": "2026-11-05T19:17:20.043", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/aozorae/Edgechat/blob/1288c66997d5e2f9eefc515cf60b2072f8d655be/worker/src/data/uploaded-files.js#L146"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/aozorae/Edgechat/commit/38cb5cf42d8014ca64624d4f4d565419b2fbeda9"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/aozorae/Edgechat/issues/58"}, {"source": "disclosure@vulncheck.com", "url": "https://hackmd.io/@hieund/edgechat-files-unauthenticated-public-attachment-disclosure"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/edgechat-before-2.20.3-missing-authentication-for-attachment-download-via-get-files-key"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://hackmd.io/@hieund/edgechat-files-unauthenticated-public-attachment-disclosure"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-306"}], "source": "disclosure@vulncheck.com", "type": "Primary"}]}

{"bugzilla": {"description": "edgechat: EdgeChat: Information disclosure via missing authentication in file download endpoint", "id": "2567654", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567654"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.7", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-306", "details": ["A flaw was found in EdgeChat. A remote, unauthenticated attacker can exploit missing access controls in the file download route to download public-channel attachments without valid credentials or channel membership. By submitting a request with an attachment identifier and omitting or providing an invalid authentication token, the attacker can cause the application to disclose sensitive file contents."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-123206", "public_date": "2026-11-05T18:16:41Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-123206\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-123206\nhttps://github.com/aozorae/Edgechat/blob/1288c66997d5e2f9eefc515cf60b2072f8d655be/worker/src/data/uploaded-files.js#L146\nhttps://github.com/aozorae/Edgechat/commit/38cb5cf42d8014ca64624d4f4d565419b2fbeda9\nhttps://github.com/aozorae/Edgechat/issues/58\nhttps://hackmd.io/@hieund/edgechat-files-unauthenticated-public-attachment-disclosure\nhttps://www.vulncheck.com/advisories/edgechat-before-2.20.3-missing-authentication-for-attachment-download-via-get-files-key"], "statement": "This vulnerability is rated as Low impact because exploitation requires possessing a specific attachment identifier in advance and only discloses files from public channels without enabling privilege escalation or system compromise. Furthermore, EdgeChat is not shipped or supported in any Red Hat enterprise offerings, leaving default product environments unaffected.", "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2.20.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "EdgeChat", "source": "cna", "vendor": "aozorae"}, "product": "edgechat", "vendor": "aozorae"}], "created": "2026-11-05T20:15:12.889864+00:00", "updated": "2026-11-06T16:35:27.907090+00:00", "vendors": ["aozorae", "aozorae$PRODUCT$edgechat"]}