Threats affecting pkg:github/EdgeChat

EdgeChat versions before 2.20.3 have a missing authentication vulnerability in the GET /files/:key route. This flaw allows unauthenticated or banned users to download decrypted public-channel attachments by exploiting the canAccessFile() function, which accepts a null user ID. Attackers with an attachment object key can retrieve plaintext attachments without a valid session or channel membership.