Threats tagged 'ghsa-24j8-6f8g-7442'

EdgeChat versions prior to 2.20.3 have a vulnerability in the GET /files/:key route where authentication is missing. This flaw allows unauthenticated or banned users to download decrypted attachments from public channels by exploiting the canAccessFile() function, which improperly accepts a null user ID. Attackers with the attachment key can retrieve plaintext files without a valid session or channel membership.