Eclipse Theia file endpoints serve any file without a token

high severity · published 2026-08-05

In browser (non-Electron) deployments of Eclipse Theia before 1.74.0, file-download endpoints are reachable without a valid connection token and can stream any file on the machine, not just files in the workspace. An attacker with network access can therefore read sensitive files such as keys or credentials.

Fixed in: 1.74.0

CVE: CVE-2026-61891

Source: NVD

Am I affected?

You are affected if the installed version is older than 1.74.0. Check the version you have and update to 1.74.0 or later. The fixed version is verified against a vendor or advisory source.

Get the fix

FixLane has a reviewed fix procedure for this incident: a read-only check first, then the fix. Ask the Telegram bot, or connect an AI agent to the FixLane MCP server and call get_fix_prompt with incident id 123 and your operating system.