PT-2026-60487 · Microsoft · Simplechat

CVE-2026-57205 · Publicado 2026-07-16 · Atualizado 2026-07-16

NVD

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.241.203, the authenticated GET /api/user/info/ and GET /api/user/profile-image/ endpoints in application/single app/route backend users.py accepted a caller-supplied user id and read the matching Cosmos DB user-settings document without object-level authorization, allowing a low-privilege authenticated user to retrieve another user's email address, display name, and profile image. This issue is fixed in version 0.241.203.

Correção

Information Disclosure

Missing Authorization

IDOR

Enumeração de Fraquezas

CWE-200

CWE-862

CWE-639

Identificadores relacionados

CVE-2026-57205

Produtos afetados

Simplechat

Referências · 4

• https://github.com/microsoft/simplechat/blob/main/docs/explanation/fixes/USER_PROFILE_IDOR_AUTHORIZATION_FIX.md · Nota
• https://github.com/microsoft/simplechat/releases/tag/v0.250.001 · Nota
• https://github.com/microsoft/simplechat/security/advisories/GHSA-x2jq-2m5m-65m4 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-57205 · Nota de Segurança