PT-2026-60487 · Microsoft · Simplechat

CVE-2026-57205 · Published 2026-07-16 · Updated 2026-07-16

NVD

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.241.203, the authenticated GET /api/user/info/ and GET /api/user/profile-image/ endpoints in application/single app/route backend users.py accepted a caller-supplied user id and read the matching Cosmos DB user-settings document without object-level authorization, allowing a low-privilege authenticated user to retrieve another user's email address, display name, and profile image. This issue is fixed in version 0.241.203.

Fix

Information Disclosure

Missing Authorization

IDOR

Weakness Enumeration

CWE-200

CWE-862

CWE-639

Related Identifiers

CVE-2026-57205

Affected Products

Simplechat

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-57205 · Security Note
• https://github.com/microsoft/simplechat/blob/main/docs/explanation/fixes/USER_PROFILE_IDOR_AUTHORIZATION_FIX.md · Note
• https://github.com/microsoft/simplechat/releases/tag/v0.250.001 · Note
• https://github.com/microsoft/simplechat/security/advisories/GHSA-x2jq-2m5m-65m4 · Note