Description

EdgeChat before 2.20.3 contains a missing authentication vulnerability in the GET /files/:key route that allows unauthenticated or banned users to download decrypted public-channel attachments because canAccessFile() accepts a null user id. Attackers holding an attachment object key can omit or supply an invalid token to retrieve plaintext attachments without a session or channel membership.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.7",
  "pubDate": "2026-11-05T19:17:20.043Z",
  "pubdate": "2026-11-05T19:17:20.043Z",
  "executiveSummary": "EdgeChat versions prior to 2.20.3 are susceptible to a critical missing authentication vulnerability within the file retrieval subsystem. This flaw resides in the GET /files/:key route, where the application fails to properly validate user identity before permitting file access.\nThe vulnerability is characterized by the failure of the canAccessFile() function to enforce authentication requirements when a null user ID is provided. Consequently, any actor possessing a valid file key can bypass access controls, regardless of their authorization status, session validity, or channel membership.\nThis vulnerability poses a significant risk to data confidentiality, as it allows unauthenticated, unauthorized, or previously banned users to retrieve and download decrypted plaintext attachments stored within public channels. The exploitation requires no elevated privileges or prior authentication, making it a low-complexity attack vector for unauthorized data exfiltration.\nOrganizations deploying EdgeChat should prioritize upgrading to version 2.20.3 or later to remediate the underlying access control logic flaw and protect sensitive channel data from unauthorized access.",
  "technicalDetails": "The vulnerability is rooted in a flawed implementation of authorization logic within the application's backend. Specifically, the GET /files/:key route relies on the canAccessFile() function to determine if a requestor possesses the appropriate permissions to download a requested attachment key.\nAnalysis of the vulnerable component reveals that canAccessFile() improperly handles cases where the user ID parameter is null or missing. In its original state, the function erroneously treats these conditions as valid for public-channel attachments, failing to verify the requestor's session token or group membership status.\nThe attack flow proceeds as follows: An attacker acquires a target attachment key, which may be discoverable through message inspection or other information disclosure channels. The attacker then submits an HTTP GET request to the /files/:key endpoint, intentionally omitting the authentication token or supplying an invalid/malformed token.\nBecause the application logic does not strictly mandate a non-null user ID for public channel resources, the system grants the request. The server proceeds to bypass the intended authorization check, decrypting the requested object on behalf of the unauthenticated user and returning the plaintext file content directly to the attacker's client.\nThis vulnerability is present in all versions of EdgeChat prior to 2.20.3. The attack can be conducted over any network path that has access to the application's API endpoints. Since the system treats missing or invalid authentication as a pass-through condition, there are no effective barrier controls for non-members or banned users against public channel files.\nPost-exploitation impact includes the total loss of confidentiality for all files distributed via public channels. Attackers can automate the retrieval process by iterating through known or discovered attachment keys, enabling bulk exfiltration of sensitive information without triggering traditional authentication-based security alerts."
}