CVE-2026-105797
HighCVSS 8.8Summary
SimpleChat versions 0.261.003 and 0.261.027 contain an authorization ordering flaw in POST /api/user/plugins that allows an authenticated low-privileged user to bypass the _reject_non_admin_mcp_stdio check. This can lead to starting an attacker-selected OS process under the application service identity. This is fixed in version 0.261.031.
Risk Assessment
The risk involves potential execution of a malicious process in the service context, compromising data confidentiality and integrity or disrupting the service.
Recommendation
Upgrade SimpleChat to version 0.261.031 or later and restrict enabling personal plugins and MCP permissions.
Other vulnerabilities in SimpleChat
See all- CVE-2026-105798High
SimpleChat versions prior to 0.261.029 contain an XSS vulnerability in POST /api/group_documents/upload. An attacker with Owner, Admin, or DocumentManager privileges can persist a script that executes in the SimpleChat origin when another group member clicks Share, allowing access to victim-visible data and actions. This is fixed in version 0.261.029.
- CVE-2026-57205Medium
In SimpleChat prior to version 0.241.203, the authenticated GET /api/user/info/<user_id> and GET /api/user/profile-image/<user_id> endpoints lacked object-level authorization. A low-privilege authenticated user could supply an arbitrary user_id and read the corresponding Cosmos DB user-settings document, retrieving another user's email address, display name, and profile image.
- CVE-2026-57206High
In SimpleChat prior to version 0.241.206, several plugin validation routes lacked enforcement of authentication and authorization at runtime. Routes such as POST /api/admin/plugins/test-instantiation, GET /api/admin/plugins/health-check/<plugin_name>, POST /api/admin/plugins/repair/<plugin_name>, and POST /api/plugins/validate were documented as requiring security but did not check if the user was logged in or had proper permissions. This allowed unauthenticated or unauthorized clients to invoke plugin validation, health check, and repair operations.
Original NVD description (English source)
SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. In versions 0.261.003 and 0.261.027, an authorization ordering flaw in POST /api/user/plugins allows an authenticated low-privileged user to omit the top-level MCP type so that _reject_non_admin_mcp_stdio skips inspection before the type is restored from metadata. The stored personal action can then reach McpPluginFactory.create_connector, and MCPStdioPlugin.connect starts the attacker-selected operating-system process under the application service identity when the action tool is invoked. Exploitation requires personal plugins to be enabled and governance to permit MCP actions, and it can expose or modify secrets and data available to the service or disrupt the service. This issue is fixed in version 0.261.031.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS