Description

A flaw has been found in sdcb chats up to 1.12.0. This impacts the function DownloadPublic of the file src/BE/web/Controllers/Chats/Files/FileController.cs of the component Signed File Download Endpoint. This manipulation causes missing authentication. Remote exploitation of the attack is possible. The attack's complexity is rated as high. The exploitability is said to be difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.7",
  "pubDate": "2026-08-31T21:17:54.330Z",
  "pubdate": "2026-08-31T21:17:54.330Z",
  "executiveSummary": "A critical security vulnerability identified as missing authentication exists within the sdcb chats application, affecting versions up to 1.12.0.\nThe vulnerability resides within the 'Signed File Download Endpoint', specifically impacting the 'DownloadPublic' function located in 'src/BE/web/Controllers/Chats/Files/FileController.cs'.\nThis flaw allows unauthorized remote actors to bypass security controls and access sensitive files that should otherwise be protected by authentication mechanisms.\nWhile the exploitation complexity is rated as high and the exploitability as difficult, the public availability of exploit code increases the risk to unpatched deployments.\nThe vendor has remained unresponsive to disclosure attempts, leaving users without an official patch. This necessitates immediate manual intervention to mitigate potential unauthorized data exposure.",
  "technicalDetails": "The root cause of this vulnerability is an improper implementation of access control within the 'DownloadPublic' function of the 'FileController.cs' component. The application fails to validate the identity or authorization status of the requester before processing file retrieval requests.\nIn a secure implementation, an endpoint intended for 'Signed File Download' should enforce strict validation of cryptographic signatures, session tokens, or identity-based permissions before initiating the file I/O operations required for the download.\nThe vulnerable code path in 'src/BE/web/Controllers/Chats/Files/FileController.cs' facilitates unauthorized access by treating incoming HTTP requests as trusted, effectively bypassing the application's intended authentication layer for the targeted file resources.\nExploitation is achieved by constructing a malicious request directed at the 'Signed File Download Endpoint'. Since the endpoint lacks authentication checks, an attacker does not require a valid user account or privileged session to interact with the function.\nThe attack flow follows a direct trajectory: 1) The attacker identifies the publicly accessible endpoint associated with 'DownloadPublic'; 2) The attacker crafts a request, potentially utilizing publicly available exploit techniques to bypass any superficial checks; 3) The server-side controller executes the file download logic without verifying if the user has the requisite authority to access the requested file identifier; 4) The application returns the file content, leading to a complete compromise of confidentiality for protected data.\nThe technical environment exposed includes the network-facing web controller responsible for handling file interactions. Given that this is a remote exploitation scenario, an attacker can initiate this process from any network segment that has routing to the affected 'sdcb chats' instance.\nThe post-exploitation impact is limited to the unauthorized disclosure of information. By accessing files through this improperly secured function, an attacker could exfiltrate sensitive data, private chat attachments, or configuration files that were intended to be restricted. Due to the lack of patch availability from the vendor, the exposure persists indefinitely until the implementation is manually altered to include robust authentication checks or the endpoint is disabled."
}