PT-2026-60488 · Microsoft · Simplechat

CVE-2026-57206 · Publicado 2026-07-16 · Atualizado 2026-07-16

NVD

CVSS v3.1

8.6

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.241.206, several plugin validation routes in application/single app/plugin validation endpoint.py, including POST /api/admin/plugins/test-instantiation, GET /api/admin/plugins/health-check/<plugin name>, POST /api/admin/plugins/repair/<plugin name>, and POST /api/plugins/validate, relied on @swagger route(security=get auth security()) documentation without enforcing @login required, @user required, or @admin required at runtime, allowing unauthenticated or unauthorized clients to invoke plugin validation, health, and repair behavior. This issue is fixed in version 0.241.206.

Correção

Missing Authentication

Missing Authorization

Enumeração de Fraquezas

CWE-306

CWE-862

Identificadores relacionados

CVE-2026-57206

Produtos afetados

Simplechat

Referências · 4

• https://github.com/microsoft/simplechat/releases/tag/v0.250.001 · Nota
• https://github.com/microsoft/simplechat/blob/main/docs/explanation/fixes/PLUGIN_VALIDATION_ROUTE_AUTH_FIX.md · Nota
• https://github.com/microsoft/simplechat/security/advisories/GHSA-g6gr-xp46-hrmj · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-57206 · Nota de Segurança