Executive brief
sdcb Chats is a collaborative messaging platform that allows users to share files securely. A flaw in the public file download endpoint allows anyone who obtains a signed file URL to download files without logging in, bypassing the intended authentication control. This could expose user-uploaded files if their signed URLs are discovered or leaked.
Technical details
A missing authentication vulnerability exists in the DownloadPublic function of FileController.cs (src/BE/web/Controllers/Chats/Files/). The endpoint is marked with [AllowAnonymous] and verifies only the signed URL (encryptedFileId, validBefore, hash parameters) but does not enforce user authentication or file ownership checks. Once the signature is validated, the file is served directly without requiring a logged-in session or ownership verification, contrasting sharply with the private download endpoint which properly requires authentication. The attack is network-accessible and requires only knowledge of a valid signed file URL; no user interaction or authentication credentials are needed. An attacker who learns a signed URL can indefinitely download the associated file. Patches or vendor updates are not documented in the advisory.
Affected products
- sdcb Chats up to 1.12.0
Timeline
- 2026-08-31: disclosed
- other: Exploit/PoC published; vendor did not respond to early disclosure