CVE-2026-57206

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-57206
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57206.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-57206
Aliases
  • GHSA-g6gr-xp46-hrmj
Published
2026-07-16T15:17:05.558Z
Modified
2026-07-18T03:47:51.159435255Z
Severity
  • 8.6 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L CVSS Calculator
Summary
SimpleChat plugin validation endpoints missing authentication and authorization
Details

SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.241.206, several plugin validation routes in application/singleapp/pluginvalidationendpoint.py, including POST /api/admin/plugins/test-instantiation, GET /api/admin/plugins/health-check/<plugin_name>, POST /api/admin/plugins/repair/<plugin_name>, and POST /api/plugins/validate, relied on @swaggerroute(security=getauthsecurity()) documentation without enforcing @loginrequired, @userrequired, or @admin_required at runtime, allowing unauthenticated or unauthorized clients to invoke plugin validation, health, and repair behavior. This issue is fixed in version 0.241.206.

Database specific 
{
    "cwe_ids": [
        "CWE-306",
        "CWE-862"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57206.json",
    "cna_assigner": "GitHub_M",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "fixed": "0.241.206"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/microsoft/simplechat

Affected ranges

Type
GIT
Repo
https://github.com/microsoft/simplechat
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ff8059163e09ede433003b1ed2822061c41239fe
Database specific 
{
    "source": "REFERENCES"
}

Affected versions

0.*
0.190.1
0.190.3
0.202.37
0.202.41
v0.*
v0.179.group_documents.13
v0.185.0
v0.185.1
v0.191.0
v0.196.9
v0.199.3
v0.201.5
v0.202.21
v0.203.15
v0.203.16
v0.212.078
v0.212.079
v0.212.091
v0.213.001
v0.213.003
v0.214.001
v0.215.34
v0.215.35
v0.215.36
v0.215.37
v0.215.38
v0.229.001
v0.229.002
v0.229.014
v0.229.058
v0.229.060
v0.229.061
v0.229.062
v0.229.063
v0.229.098
v0.235.001
v0.235.003
v0.235.012
v0.235.025
v0.237.001
v0.237.003
v0.237.004
v0.237.005
v0.237.006
v0.237.007
v0.237.009
v0.237.011
v0.239.001
v0.239.002
v0.241.001
v0.241.002
v0.241.006
v0.241.007

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57206.json"