Tencent Docs Desktop versions 3.9.20 and earlier have a vulnerability due to missing SSL certificate validation in the update component. This flaw allows an attacker to perform man-in-the-middle attacks during the update process, potentially leading to the delivery of malicious updates. The vulnerability has a high severity rating with a CVSS score of 7.5, indicating significant confidentiality impact but no integrity or availability impact is noted.