CVE-2026-82906: Missing Authentication in sdcb chats

This vulnerability exists in the DownloadPublic function of the Signed File Download Endpoint component in sdcb chats versions up to 1.12.0. The issue is a missing authentication check, which could allow remote attackers to access files without proper authorization. The attack complexity is high, and no privileges or user interaction are required. Exploit code has been published, but exploitation is considered difficult. The vendor has not provided any response or remediation guidance.

The vulnerability allows unauthorized remote access to files via the DownloadPublic endpoint due to missing authentication. This could lead to exposure of sensitive files. However, the attack complexity is high and exploitability is difficult, which reduces the likelihood of widespread exploitation. There are no indications of privilege escalation, user interaction, or confidentiality/integrity/availability impacts beyond unauthorized file access.

No official patch or remediation is currently available, and the vendor has not responded to disclosure attempts. Users should monitor vendor communications for updates. Until a fix is released, restricting access to the affected endpoint or implementing additional authentication controls at the network or application layer may help mitigate risk.