CVE-2026-123206
Description
A flaw was found in EdgeChat. A remote, unauthenticated attacker can exploit missing access controls in the file download route to download public-channel attachments without valid credentials or channel membership. By submitting a request with an attachment identifier and omitting or providing an invalid authentication token, the attacker can cause the application to disclose sensitive file contents.
Statement
This vulnerability is rated as Low impact because exploitation requires possessing a specific attachment identifier in advance and only discloses files from public channels without enabling privilege escalation or system compromise. Furthermore, EdgeChat is not shipped or supported in any Red Hat enterprise offerings, leaving default product environments unaffected.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Understanding the Weakness (CWE)
Access Control,Other
Technical Impact: Gain Privileges or Assume Identity; Varies by Context
Exposing critical functionality essentially provides an attacker with the privilege level of that functionality. The consequences will depend on the associated functionality, but they can range from reading or modifying sensitive data, accessing administrative or other privileged functionality, or possibly even executing arbitrary code.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
