CVE-2026-57205

MediumCVSS 4.3

Published: 16/07/2026(UTC)Updated: 16/07/2026(UTC)Translated: 17/07/2026(UTC)NVD NIST

Summary

In SimpleChat prior to version 0.241.203, the authenticated GET /api/user/info/<user_id> and GET /api/user/profile-image/<user_id> endpoints lacked object-level authorization. A low-privilege authenticated user could supply an arbitrary user_id and read the corresponding Cosmos DB user-settings document, retrieving another user's email address, display name, and profile image.

Risk Assessment

The organization is at risk of leaking sensitive personal data (email, display name, profile image) of users by any authenticated user, potentially violating privacy regulations such as GDPR.

Recommendation

Immediately upgrade SimpleChat to version 0.241.203 or later, which fixes the missing object-level authorization.

Other vulnerabilities in SimpleChat

CVE-2026-57206High
In SimpleChat prior to version 0.241.206, several plugin validation routes lacked enforcement of authentication and authorization at runtime. Routes such as POST /api/admin/plugins/test-instantiation, GET /api/admin/plugins/health-check/<plugin_name>, POST /api/admin/plugins/repair/<plugin_name>, and POST /api/plugins/validate were documented as requiring security but did not check if the user was logged in or had proper permissions. This allowed unauthenticated or unauthorized clients to invoke plugin validation, health check, and repair operations.

Original NVD description (English source)

SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.241.203, the authenticated GET /api/user/info/<user_id> and GET /api/user/profile-image/<user_id> endpoints in application/single_app/route_backend_users.py accepted a caller-supplied user_id and read the matching Cosmos DB user-settings document without object-level authorization, allowing a low-privilege authenticated user to retrieve another user's email address, display name, and profile image. This issue is fixed in version 0.241.203.