CVE-2026-82906

Received Received - Intake

Missing Authentication in sdcb chats File Download Endpoint

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: VulDB

Description

A flaw has been found in sdcb chats up to 1.12.0. This impacts the function DownloadPublic of the file src/BE/web/Controllers/Chats/Files/FileController.cs of the component Signed File Download Endpoint. This manipulation causes missing authentication. Remote exploitation of the attack is possible. The attack's complexity is rated as high. The exploitability is said to be difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-31

Last Modified

2026-08-31

Generated

2026-09-01

AI Q&A

2026-09-01

EPSS Evaluated

N/A

NVD

CVE-2026-82906

Affected Vendors & Products

Vendor	Product	Version / Range
sdcb	chats	to 1.12.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability is a missing authentication flaw in the DownloadPublic function of the Signed File Download Endpoint in sdcb chats up to version 1.12.0. It allows remote attackers to exploit the system with high attack complexity but difficult exploitability. The exploit has been published and the vendor did not respond to disclosure attempts.

Impact Analysis

This vulnerability could allow unauthorized access to sensitive files via the DownloadPublic function. Attackers might exploit it to download private data without authentication, potentially leading to data breaches or information leaks.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating GDPR's data protection principles and HIPAA's security requirements. Non-compliance may result in legal penalties, fines, or reputational damage due to potential data breaches.

Mitigation Strategies

Immediately update sdcb chats to the latest version beyond 1.12.0 to address the missing authentication flaw in the Signed File Download Endpoint. If no update is available, disable or restrict access to the affected component until a patch is released.

Hi! I’m here to help you understand CVE-2026-82906. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70