EdgeChat versions prior to 2.20.3 have a missing authentication check in the GET /files/:key route. The canAccessFile function accepts a null user id, allowing attackers who possess an attachment key to download decrypted public‑channel attachments without providing a session or channel membership. This flaw enables unauthorized parties to retrieve plaintext files intended for authorized users only, potentially exposing sensitive data or user content.

The vulnerability affects the aozorae EdgeChat product, specifically versions before 2.20.3. Users running any of these versions are susceptible if they have public‑channel attachments stored with a key that can be guessed or leaked.

The CVSS score of 6.3 classifies this issue as medium severity; however, the lack of authentication can still lead to significant data exposure. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can reach the vulnerable endpoint over the network and use a valid attachment key, inheriting that access regardless of user status. The missing authorization check is the root weakness, making exploitation straightforward once the key is known.