What’s Vulnerable › Vulnerabilities

CVE-2026-57205: SimpleChat: Authenticated users can access other users' profile metadata through user IDOR endpoints

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-16 · updated 2026-10-24
• Weakness: CWE-200

Description

SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.241.203, the authenticated GET /api/user/info/<user_id> and GET /api/user/profile-image/<user_id> endpoints in application/single_app/route_backend_users.py accepted a caller-supplied user_id and read the matching Cosmos DB user-settings document without object-level authorization, allowing a low-privilege authenticated user to retrieve another user's email address, display name, and profile image. This issue is fixed in version 0.241.203.

Affected products

• microsoft simplechat: before 0.241.203

References

• https://github.com/microsoft/simplechat/blob/main/docs/explanation/fixes/USER_PROFILE_IDOR_AUTHORIZATION_FIX.md
• https://github.com/microsoft/simplechat/releases/tag/v0.250.001
• https://github.com/microsoft/simplechat/security/advisories/GHSA-x2jq-2m5m-65m4

Get alerted when CVE-2026-57205 or the next vulnerability affects your stack