CVE-2026-82906CWE-287CWE-306

CVE-2026-82906

Low · published September 1, 2026

CVSS v3.1
3.7
EPSS
1%
Percentile
46.6
In the wild
Unconfirmed
What it is

A flaw has been found in sdcb chats up to 1.12.0. This impacts the function DownloadPublic of the file src/BE/web/Controllers/Chats/Files/FileController.cs of the component Signed File Download Endpoint. This manipulation causes missing authentication. Remote exploitation of the attack is possible. The attack's complexity is rated as high. The exploitability is said to be difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v3.1
3.7 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
6.3 · CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
EPSS
0.00574 · 46.6th percentile
Weaknesses
CWE-287 · Improper Authentication; CWE-306 · Missing Authentication for Critical Function
Published
2026-09-01T01:17Z
References (5)
https://github.com/yaowenxiao721/Poc/blob/main/sdcb-chats/chats-poc-2.md · [email protected]https://vuldb.com/cve/CVE-2026-82906 · [email protected]https://vuldb.com/submit/877767 · [email protected]https://vuldb.com/vuln/397286 · [email protected]https://vuldb.com/vuln/397286/cti · [email protected]
EPSS history
Timeline
  • 02 SEP 03:40Z
    EPSS moved — → 0%
    epss
  • 31 AUG 20:00Z
    sdcb chats Signed File Download Endpoint FileController.cs DownloadPublic missing authentication
    cvelistv5